/*
  Master YARA Detection Feed - SystemHelpDesk Malware Families Catalog
  Total Families: 2,981
  Canonical URL: https://malware-families-catalog.systemhelpdesk.com/api/yara/rules.yar
  License: Apache-2.0
  Generated: 2026-10-16
*/

/*
    YARA Hunting Rules for 000C (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/000c
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_000C_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 000C (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/000c"
        date = "2026-10-16"
    strings:
        $fam_name = "000c" ascii wide nocase
        $alias_1 = "ransom:win32/000c" ascii wide nocase
        $alias_2 = "ransom.win32.000c" ascii wide nocase
        $alias_3 = "win32/000c" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_000C_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 000C tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/000c"
        date = "2026-10-16"
    strings:
        $attrib_str = "000c" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for 0Y0Auaszpblb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/0y0auaszpblb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_0Y0AUASZPBLB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 0Y0Auaszpblb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/0y0auaszpblb"
        date = "2026-10-16"
    strings:
        $fam_name = "0y0auaszpblb" ascii wide nocase
        $alias_1 = "ransom:win32/0y0auaszpblb" ascii wide nocase
        $alias_2 = "ransom.win32.0y0auaszpblb" ascii wide nocase
        $alias_3 = "win32/0y0auaszpblb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_0Y0AUASZPBLB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 0Y0Auaszpblb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/0y0auaszpblb"
        date = "2026-10-16"
    strings:
        $attrib_str = "0y0auaszpblb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for 0Y1A48Lx2Yib (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/0y1a48lx2yib
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_0Y1A48LX2YIB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 0Y1A48Lx2Yib (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/0y1a48lx2yib"
        date = "2026-10-16"
    strings:
        $fam_name = "0y1a48lx2yib" ascii wide nocase
        $alias_1 = "ransom:win32/0y1a48lx2yib" ascii wide nocase
        $alias_2 = "ransom.win32.0y1a48lx2yib" ascii wide nocase
        $alias_3 = "win32/0y1a48lx2yib" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_0Y1A48LX2YIB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 0Y1A48Lx2Yib tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/0y1a48lx2yib"
        date = "2026-10-16"
    strings:
        $attrib_str = "0y1a48lx2yib" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for 1Clickdownload (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/1clickdownload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_1CLICKDOWNLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 1Clickdownload (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/1clickdownload"
        date = "2026-10-16"
    strings:
        $fam_name = "1clickdownload" ascii wide nocase
        $alias_1 = "softwarebundler:win32/1clickdownload" ascii wide nocase
        $alias_2 = "pua:win32/1clickdownload" ascii wide nocase
        $alias_3 = "adware:win32/1clickdownload" ascii wide nocase
        $alias_4 = "win32/1clickdownload" ascii wide nocase
        $alias_5 = "1clickdownload bundler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_1CLICKDOWNLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 1Clickdownload tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/1clickdownload"
        date = "2026-10-16"
    strings:
        $attrib_str = "1clickdownload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for 1Fb728F (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/1fb728f
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_1FB728F_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 1Fb728F (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/1fb728f"
        date = "2026-10-16"
    strings:
        $fam_name = "1fb728f" ascii wide nocase
        $alias_1 = "ransom:win32/1fb728f" ascii wide nocase
        $alias_2 = "ransom.win32.1fb728f" ascii wide nocase
        $alias_3 = "win32/1fb728f" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_1FB728F_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 1Fb728F tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/1fb728f"
        date = "2026-10-16"
    strings:
        $attrib_str = "1fb728f" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for 2345Cn (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/2345cn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_2345CN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 2345Cn (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/2345cn"
        date = "2026-10-16"
    strings:
        $fam_name = "2345cn" ascii wide nocase
        $alias_1 = "browsermodifier:win32/2345cn" ascii wide nocase
        $alias_2 = "adware.2345" ascii wide nocase
        $alias_3 = "pup.hao123" ascii wide nocase
        $alias_4 = "trojan:win32/2345cn" ascii wide nocase
        $alias_5 = "trojan.win32.2345cn" ascii wide nocase
        $alias_6 = "win32/2345cn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_2345CN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 2345Cn tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/2345cn"
        date = "2026-10-16"
    strings:
        $attrib_str = "2345cn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for 2345Explorer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/2345explorer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_2345EXPLORER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 2345Explorer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/2345explorer"
        date = "2026-10-16"
    strings:
        $fam_name = "2345explorer" ascii wide nocase
        $alias_1 = "adware.2345explorer" ascii wide nocase
        $alias_2 = "pup.2345" ascii wide nocase
        $alias_3 = "browsermodifier:win32/2345explorer" ascii wide nocase
        $alias_4 = "trojan:win32/2345explorer" ascii wide nocase
        $alias_5 = "trojan.win32.2345explorer" ascii wide nocase
        $alias_6 = "win32/2345explorer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_2345EXPLORER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 2345Explorer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/2345explorer"
        date = "2026-10-16"
    strings:
        $attrib_str = "2345explorer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for 27D3E5Bc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/27d3e5bc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_27D3E5BC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 27D3E5Bc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/27d3e5bc"
        date = "2026-10-16"
    strings:
        $fam_name = "27d3e5bc" ascii wide nocase
        $alias_1 = "trojan.hash" ascii wide nocase
        $alias_2 = "malware.27d3e5bc" ascii wide nocase
        $alias_3 = "win32/27d3e5bc" ascii wide nocase
        $alias_4 = "ransom:win32/27d3e5bc" ascii wide nocase
        $alias_5 = "ransom.win32.27d3e5bc" ascii wide nocase
        $alias_6 = "win32/27d3e5bc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_27D3E5BC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 27D3E5Bc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/27d3e5bc"
        date = "2026-10-16"
    strings:
        $attrib_str = "27d3e5bc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for 3Proxy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/3proxy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_3PROXY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 3Proxy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/3proxy"
        date = "2026-10-16"
    strings:
        $fam_name = "3proxy" ascii wide nocase
        $alias_1 = "trojan:win32/3proxy" ascii wide nocase
        $alias_2 = "trojan.win32.3proxy" ascii wide nocase
        $alias_3 = "win32/3proxy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_3PROXY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 3Proxy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/3proxy"
        date = "2026-10-16"
    strings:
        $attrib_str = "3proxy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for 4Shared (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/4shared
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_4SHARED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 4Shared (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/4shared"
        date = "2026-10-16"
    strings:
        $fam_name = "4shared" ascii wide nocase
        $alias_1 = "pua:win32/4shared" ascii wide nocase
        $alias_2 = "program:win32/4shared" ascii wide nocase
        $alias_3 = "4shareddesktop" ascii wide nocase
        $alias_4 = "win32/4shared" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_4SHARED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 4Shared tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/4shared"
        date = "2026-10-16"
    strings:
        $attrib_str = "4shared" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for 5Hex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/5hex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_5HEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 5Hex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/5hex"
        date = "2026-10-16"
    strings:
        $fam_name = "5hex" ascii wide nocase
        $alias_1 = "ransom:win32/5hex" ascii wide nocase
        $alias_2 = "ransom.win32.5hex" ascii wide nocase
        $alias_3 = "win32/5hex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_5HEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 5Hex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/5hex"
        date = "2026-10-16"
    strings:
        $attrib_str = "5hex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for 5Z0Ba4Mkpih (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/5z0ba4mkpih
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_5Z0BA4MKPIH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 5Z0Ba4Mkpih (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/5z0ba4mkpih"
        date = "2026-10-16"
    strings:
        $fam_name = "5z0ba4mkpih" ascii wide nocase
        $alias_1 = "trojan.obfuscated.gen" ascii wide nocase
        $alias_2 = "dropper.randomname" ascii wide nocase
        $alias_3 = "win32/trojan.packer" ascii wide nocase
        $alias_4 = "ransom:win32/5z0ba4mkpih" ascii wide nocase
        $alias_5 = "ransom.win32.5z0ba4mkpih" ascii wide nocase
        $alias_6 = "win32/5z0ba4mkpih" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_5Z0BA4MKPIH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 5Z0Ba4Mkpih tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/5z0ba4mkpih"
        date = "2026-10-16"
    strings:
        $attrib_str = "5z0ba4mkpih" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for 6B47672C (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/6b47672c
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_6B47672C_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for 6B47672C (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/6b47672c"
        date = "2026-10-16"
    strings:
        $fam_name = "6b47672c" ascii wide nocase
        $alias_1 = "trojan.generic.6b47672c" ascii wide nocase
        $alias_2 = "malware.unknown" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
        $alias_4 = "trojan:win32/6b47672c" ascii wide nocase
        $alias_5 = "trojan.win32.6b47672c" ascii wide nocase
        $alias_6 = "win32/6b47672c" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_6B47672C_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for 6B47672C tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/6b47672c"
        date = "2026-10-16"
    strings:
        $attrib_str = "6b47672c" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for A8P9Eklc (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/a8p9eklc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_A8P9EKLC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for A8P9Eklc (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/a8p9eklc"
        date = "2026-10-16"
    strings:
        $fam_name = "a8p9eklc" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.a8p9eklc" ascii wide nocase
        $alias_3 = "heur.a8p9eklc" ascii wide nocase
        $alias_4 = "trojan:win32/a8p9eklc" ascii wide nocase
        $alias_5 = "trojan.win32.a8p9eklc" ascii wide nocase
        $alias_6 = "win32/a8p9eklc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_A8P9EKLC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for A8P9Eklc tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/a8p9eklc"
        date = "2026-10-16"
    strings:
        $attrib_str = "a8p9eklc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for A_311_Death (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/a_311_death
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_A_311_DEATH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for A_311_Death (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/a_311_death"
        date = "2026-10-16"
    strings:
        $fam_name = "a_311_death" ascii wide nocase
        $alias_1 = "haxdoor" ascii wide nocase
        $alias_2 = "a-311" ascii wide nocase
        $alias_3 = "trojan.haxdoor.a311" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_A_311_DEATH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for A_311_Death tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/a_311_death"
        date = "2026-10-16"
    strings:
        $attrib_str = "a_311_death" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Aauto (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aauto
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AAUTO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aauto (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aauto"
        date = "2026-10-16"
    strings:
        $fam_name = "aauto" ascii wide nocase
        $alias_1 = "trojan:win32/aauto" ascii wide nocase
        $alias_2 = "trojandownloader:win32/aauto" ascii wide nocase
        $alias_3 = "win32/aauto" ascii wide nocase
        $alias_4 = "aauto script loader" ascii wide nocase
        $alias_5 = "trojan.aauto" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AAUTO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aauto tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aauto"
        date = "2026-10-16"
    strings:
        $attrib_str = "aauto" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Accelerator (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/accelerator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ACCELERATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Accelerator (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/accelerator"
        date = "2026-10-16"
    strings:
        $fam_name = "accelerator" ascii wide nocase
        $alias_1 = "backdoor:win32/accelerator" ascii wide nocase
        $alias_2 = "backdoor.win32.accelerator" ascii wide nocase
        $alias_3 = "win32/accelerator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ACCELERATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Accelerator tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/accelerator"
        date = "2026-10-16"
    strings:
        $attrib_str = "accelerator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Acid_Drop (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/acid_drop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ACID_DROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Acid_Drop (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/acid_drop"
        date = "2026-10-16"
    strings:
        $fam_name = "acid_drop" ascii wide nocase
        $alias_1 = "aciddrop" ascii wide nocase
        $alias_2 = "backdoor.aciddrop" ascii wide nocase
        $alias_3 = "trojan.aciddrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ACID_DROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Acid_Drop tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/acid_drop"
        date = "2026-10-16"
    strings:
        $attrib_str = "acid_drop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Activator (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/activator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ACTIVATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Activator (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/activator"
        date = "2026-10-16"
    strings:
        $fam_name = "activator" ascii wide nocase
        $alias_1 = "hacktool.activator" ascii wide nocase
        $alias_2 = "riskware.kmspico" ascii wide nocase
        $alias_3 = "crack.win32" ascii wide nocase
        $alias_4 = "tool.kmsauto" ascii wide nocase
        $alias_5 = "ransom:win32/activator" ascii wide nocase
        $alias_6 = "ransom.win32.activator" ascii wide nocase
        $alias_7 = "win32/activator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ACTIVATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Activator tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/activator"
        date = "2026-10-16"
    strings:
        $attrib_str = "activator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Activitymonitor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/activitymonitor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ACTIVITYMONITOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Activitymonitor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/activitymonitor"
        date = "2026-10-16"
    strings:
        $fam_name = "activitymonitor" ascii wide nocase
        $alias_1 = "trojan:win32/activitymonitor" ascii wide nocase
        $alias_2 = "trojan.win32.activitymonitor" ascii wide nocase
        $alias_3 = "win32/activitymonitor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ACTIVITYMONITOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Activitymonitor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/activitymonitor"
        date = "2026-10-16"
    strings:
        $attrib_str = "activitymonitor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Adaebook (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adaebook
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADAEBOOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adaebook (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adaebook"
        date = "2026-10-16"
    strings:
        $fam_name = "adaebook" ascii wide nocase
        $alias_1 = "adware:win32/adaebook" ascii wide nocase
        $alias_2 = "pua:win32/adaebook" ascii wide nocase
        $alias_3 = "trojan:win32/adaebook" ascii wide nocase
        $alias_4 = "win32/adaebook" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADAEBOOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adaebook tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adaebook"
        date = "2026-10-16"
    strings:
        $attrib_str = "adaebook" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Adagent (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adagent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADAGENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adagent (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adagent"
        date = "2026-10-16"
    strings:
        $fam_name = "adagent" ascii wide nocase
        $alias_1 = "adware.adagent" ascii wide nocase
        $alias_2 = "pup.adagent" ascii wide nocase
        $alias_3 = "browsermodifier.adagent" ascii wide nocase
        $alias_4 = "ransom:win32/adagent" ascii wide nocase
        $alias_5 = "ransom.win32.adagent" ascii wide nocase
        $alias_6 = "win32/adagent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADAGENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adagent tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adagent"
        date = "2026-10-16"
    strings:
        $attrib_str = "adagent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Adanti (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adanti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADANTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adanti (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adanti"
        date = "2026-10-16"
    strings:
        $fam_name = "adanti" ascii wide nocase
        $alias_1 = "adware.adanti" ascii wide nocase
        $alias_2 = "pup.adanti" ascii wide nocase
        $alias_3 = "adanti adware" ascii wide nocase
        $alias_4 = "trojan:win32/adanti" ascii wide nocase
        $alias_5 = "trojan.win32.adanti" ascii wide nocase
        $alias_6 = "win32/adanti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADANTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adanti tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adanti"
        date = "2026-10-16"
    strings:
        $attrib_str = "adanti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Adbreak (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adbreak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADBREAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adbreak (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adbreak"
        date = "2026-10-16"
    strings:
        $fam_name = "adbreak" ascii wide nocase
        $alias_1 = "adware.adbreak" ascii wide nocase
        $alias_2 = "browserhijacker.adbreak" ascii wide nocase
        $alias_3 = "pup.adbreak" ascii wide nocase
        $alias_4 = "ransom:win32/adbreak" ascii wide nocase
        $alias_5 = "ransom.win32.adbreak" ascii wide nocase
        $alias_6 = "win32/adbreak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADBREAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adbreak tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adbreak"
        date = "2026-10-16"
    strings:
        $attrib_str = "adbreak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Adcrypterlib (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adcrypterlib
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADCRYPTERLIB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adcrypterlib (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adcrypterlib"
        date = "2026-10-16"
    strings:
        $fam_name = "adcrypterlib" ascii wide nocase
        $alias_1 = "trojan.crypter" ascii wide nocase
        $alias_2 = "packer.adcrypterlib" ascii wide nocase
        $alias_3 = "win32/crypter" ascii wide nocase
        $alias_4 = "ransom:win32/adcrypterlib" ascii wide nocase
        $alias_5 = "ransom.win32.adcrypterlib" ascii wide nocase
        $alias_6 = "win32/adcrypterlib" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADCRYPTERLIB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adcrypterlib tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adcrypterlib"
        date = "2026-10-16"
    strings:
        $attrib_str = "adcrypterlib" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Addlyrics (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/addlyrics
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADDLYRICS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Addlyrics (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/addlyrics"
        date = "2026-10-16"
    strings:
        $fam_name = "addlyrics" ascii wide nocase
        $alias_1 = "trojan:win32/addlyrics" ascii wide nocase
        $alias_2 = "trojan.win32.addlyrics" ascii wide nocase
        $alias_3 = "win32/addlyrics" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADDLYRICS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Addlyrics tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/addlyrics"
        date = "2026-10-16"
    strings:
        $attrib_str = "addlyrics" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Addmepoint (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/addmepoint
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADDMEPOINT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Addmepoint (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/addmepoint"
        date = "2026-10-16"
    strings:
        $fam_name = "addmepoint" ascii wide nocase
        $alias_1 = "trojan:win32/addmepoint" ascii wide nocase
        $alias_2 = "trojan.win32.addmepoint" ascii wide nocase
        $alias_3 = "win32/addmepoint" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADDMEPOINT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Addmepoint tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/addmepoint"
        date = "2026-10-16"
    strings:
        $attrib_str = "addmepoint" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Addrop (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/addrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADDROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Addrop (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/addrop"
        date = "2026-10-16"
    strings:
        $fam_name = "addrop" ascii wide nocase
        $alias_1 = "adware:win32/addrop" ascii wide nocase
        $alias_2 = "adware.addrop" ascii wide nocase
        $alias_3 = "pua:win32/addrop" ascii wide nocase
        $alias_4 = "trojan.win32.addrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADDROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Addrop tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/addrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "addrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Adduser (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adduser
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADDUSER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adduser (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adduser"
        date = "2026-10-16"
    strings:
        $fam_name = "adduser" ascii wide nocase
        $alias_1 = "backdoor:win32/adduser" ascii wide nocase
        $alias_2 = "backdoor.win32.adduser" ascii wide nocase
        $alias_3 = "win32/adduser" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADDUSER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adduser tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adduser"
        date = "2026-10-16"
    strings:
        $attrib_str = "adduser" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Adgazelle (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adgazelle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADGAZELLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adgazelle (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adgazelle"
        date = "2026-10-16"
    strings:
        $fam_name = "adgazelle" ascii wide nocase
        $alias_1 = "trojan:win32/adgazelle" ascii wide nocase
        $alias_2 = "trojan.win32.adgazelle" ascii wide nocase
        $alias_3 = "win32/adgazelle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADGAZELLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adgazelle tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adgazelle"
        date = "2026-10-16"
    strings:
        $attrib_str = "adgazelle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Adinstaller (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adinstaller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADINSTALLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adinstaller (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adinstaller"
        date = "2026-10-16"
    strings:
        $fam_name = "adinstaller" ascii wide nocase
        $alias_1 = "trojan:win32/adinstaller" ascii wide nocase
        $alias_2 = "trojan.win32.adinstaller" ascii wide nocase
        $alias_3 = "win32/adinstaller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADINSTALLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adinstaller tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adinstaller"
        date = "2026-10-16"
    strings:
        $attrib_str = "adinstaller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Adject (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adject
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADJECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adject (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adject"
        date = "2026-10-16"
    strings:
        $fam_name = "adject" ascii wide nocase
        $alias_1 = "ransom:win32/adject" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.adject" ascii wide nocase
        $alias_3 = "win32/adject" ascii wide nocase
        $alias_4 = "adject ransomware" ascii wide nocase
        $alias_5 = "ransom.adject" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADJECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adject tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adject"
        date = "2026-10-16"
    strings:
        $attrib_str = "adject" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Adkdllwrapper (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adkdllwrapper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADKDLLWRAPPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adkdllwrapper (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adkdllwrapper"
        date = "2026-10-16"
    strings:
        $fam_name = "adkdllwrapper" ascii wide nocase
        $alias_1 = "trojan:win32/adkdllwrapper" ascii wide nocase
        $alias_2 = "trojan.win32.adkdllwrapper" ascii wide nocase
        $alias_3 = "win32/adkdllwrapper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADKDLLWRAPPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adkdllwrapper tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adkdllwrapper"
        date = "2026-10-16"
    strings:
        $attrib_str = "adkdllwrapper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Adkor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adkor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADKOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adkor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adkor"
        date = "2026-10-16"
    strings:
        $fam_name = "adkor" ascii wide nocase
        $alias_1 = "trojan:win32/adkor" ascii wide nocase
        $alias_2 = "trojan.win32.adkor" ascii wide nocase
        $alias_3 = "win32/adkor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADKOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adkor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adkor"
        date = "2026-10-16"
    strings:
        $attrib_str = "adkor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Adkubru (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adkubru
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADKUBRU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adkubru (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adkubru"
        date = "2026-10-16"
    strings:
        $fam_name = "adkubru" ascii wide nocase
        $alias_1 = "ransom:win32/adkubru" ascii wide nocase
        $alias_2 = "ransom.win32.adkubru" ascii wide nocase
        $alias_3 = "win32/adkubru" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADKUBRU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adkubru tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adkubru"
        date = "2026-10-16"
    strings:
        $attrib_str = "adkubru" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Admedia (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/admedia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADMEDIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Admedia (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/admedia"
        date = "2026-10-16"
    strings:
        $fam_name = "admedia" ascii wide nocase
        $alias_1 = "trojan:win32/admedia" ascii wide nocase
        $alias_2 = "trojan.win32.admedia" ascii wide nocase
        $alias_3 = "win32/admedia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADMEDIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Admedia tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/admedia"
        date = "2026-10-16"
    strings:
        $attrib_str = "admedia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Admoke (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/admoke
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADMOKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Admoke (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/admoke"
        date = "2026-10-16"
    strings:
        $fam_name = "admoke" ascii wide nocase
        $alias_1 = "ransom:win32/admoke" ascii wide nocase
        $alias_2 = "ransom.win32.admoke" ascii wide nocase
        $alias_3 = "win32/admoke" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADMOKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Admoke tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/admoke"
        date = "2026-10-16"
    strings:
        $attrib_str = "admoke" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Adodb (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adodb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADODB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adodb (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adodb"
        date = "2026-10-16"
    strings:
        $fam_name = "adodb" ascii wide nocase
        $alias_1 = "backdoor:win32/adodb" ascii wide nocase
        $alias_2 = "backdoor.win32.adodb" ascii wide nocase
        $alias_3 = "win32/adodb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADODB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adodb tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adodb"
        date = "2026-10-16"
    strings:
        $attrib_str = "adodb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Adpernok (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adpernok
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADPERNOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adpernok (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adpernok"
        date = "2026-10-16"
    strings:
        $fam_name = "adpernok" ascii wide nocase
        $alias_1 = "adware.adpernok" ascii wide nocase
        $alias_2 = "pup.adpernok" ascii wide nocase
        $alias_3 = "browserhijacker.adpernok" ascii wide nocase
        $alias_4 = "ransom:win32/adpernok" ascii wide nocase
        $alias_5 = "ransom.win32.adpernok" ascii wide nocase
        $alias_6 = "win32/adpernok" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADPERNOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adpernok tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adpernok"
        date = "2026-10-16"
    strings:
        $attrib_str = "adpernok" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Adposhel (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adposhel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADPOSHEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adposhel (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adposhel"
        date = "2026-10-16"
    strings:
        $fam_name = "adposhel" ascii wide nocase
        $alias_1 = "adware:win32/adposhel" ascii wide nocase
        $alias_2 = "adware.adposhel" ascii wide nocase
        $alias_3 = "pua:win32/adposhel" ascii wide nocase
        $alias_4 = "browsefox variant" ascii wide nocase
        $alias_5 = "win32/adposhel.a" ascii wide nocase
        $alias_6 = "adposhel adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADPOSHEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adposhel tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adposhel"
        date = "2026-10-16"
    strings:
        $attrib_str = "adposhel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Adpower (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adpower
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADPOWER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adpower (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adpower"
        date = "2026-10-16"
    strings:
        $fam_name = "adpower" ascii wide nocase
        $alias_1 = "adware.adpower" ascii wide nocase
        $alias_2 = "pup.adpower" ascii wide nocase
        $alias_3 = "win32/adware.adpower" ascii wide nocase
        $alias_4 = "ransom:win32/adpower" ascii wide nocase
        $alias_5 = "ransom.win32.adpower" ascii wide nocase
        $alias_6 = "win32/adpower" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADPOWER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adpower tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adpower"
        date = "2026-10-16"
    strings:
        $attrib_str = "adpower" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Adspy (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adspy (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adspy"
        date = "2026-10-16"
    strings:
        $fam_name = "adspy" ascii wide nocase
        $alias_1 = "pws:win32/adspy" ascii wide nocase
        $alias_2 = "pws.win32.adspy" ascii wide nocase
        $alias_3 = "win32/adspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adspy tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "adspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Advancedpccare (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/advancedpccare
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADVANCEDPCCARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Advancedpccare (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/advancedpccare"
        date = "2026-10-16"
    strings:
        $fam_name = "advancedpccare" ascii wide nocase
        $alias_1 = "adware:win32/advancedpccare" ascii wide nocase
        $alias_2 = "adware.win32.advancedpccare" ascii wide nocase
        $alias_3 = "win32/advancedpccare" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADVANCEDPCCARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Advancedpccare tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/advancedpccare"
        date = "2026-10-16"
    strings:
        $attrib_str = "advancedpccare" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Advload (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/advload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADVLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Advload (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/advload"
        date = "2026-10-16"
    strings:
        $fam_name = "advload" ascii wide nocase
        $alias_1 = "trojan:win32/advload" ascii wide nocase
        $alias_2 = "trojan.win32.advload" ascii wide nocase
        $alias_3 = "win32/advload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADVLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Advload tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/advload"
        date = "2026-10-16"
    strings:
        $attrib_str = "advload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Advpassman (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/advpassman
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADVPASSMAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Advpassman (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/advpassman"
        date = "2026-10-16"
    strings:
        $fam_name = "advpassman" ascii wide nocase
        $alias_1 = "pup.advpassman" ascii wide nocase
        $alias_2 = "riskware.passwordmanager" ascii wide nocase
        $alias_3 = "tool.advpassman" ascii wide nocase
        $alias_4 = "pws:win32/advpassman" ascii wide nocase
        $alias_5 = "pws.win32.advpassman" ascii wide nocase
        $alias_6 = "win32/advpassman" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADVPASSMAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Advpassman tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/advpassman"
        date = "2026-10-16"
    strings:
        $attrib_str = "advpassman" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Adwapper (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adwapper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADWAPPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adwapper (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adwapper"
        date = "2026-10-16"
    strings:
        $fam_name = "adwapper" ascii wide nocase
        $alias_1 = "trojan:win32/adwapper" ascii wide nocase
        $alias_2 = "trojan.win32.adwapper" ascii wide nocase
        $alias_3 = "win32/adwapper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADWAPPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adwapper tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adwapper"
        date = "2026-10-16"
    strings:
        $attrib_str = "adwapper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Adwaresig (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adwaresig
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADWARESIG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adwaresig (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adwaresig"
        date = "2026-10-16"
    strings:
        $fam_name = "adwaresig" ascii wide nocase
        $alias_1 = "adware.generic" ascii wide nocase
        $alias_2 = "pup.adwaresig" ascii wide nocase
        $alias_3 = "suspicious.adware" ascii wide nocase
        $alias_4 = "adware:win32/adwaresig" ascii wide nocase
        $alias_5 = "adware.win32.adwaresig" ascii wide nocase
        $alias_6 = "win32/adwaresig" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADWARESIG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adwaresig tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adwaresig"
        date = "2026-10-16"
    strings:
        $attrib_str = "adwaresig" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Adwind (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adwind
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADWIND_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adwind (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adwind"
        date = "2026-10-16"
    strings:
        $fam_name = "adwind" ascii wide nocase
        $alias_1 = "trojan:win32/adwind" ascii wide nocase
        $alias_2 = "trojan.win32.adwind" ascii wide nocase
        $alias_3 = "win32/adwind" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADWIND_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adwind tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adwind"
        date = "2026-10-16"
    strings:
        $attrib_str = "adwind" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Adylkuzz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/adylkuzz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ADYLKUZZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Adylkuzz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adylkuzz"
        date = "2026-10-16"
    strings:
        $fam_name = "adylkuzz" ascii wide nocase
        $alias_1 = "ransom:win32/adylkuzz" ascii wide nocase
        $alias_2 = "ransom.win32.adylkuzz" ascii wide nocase
        $alias_3 = "win32/adylkuzz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ADYLKUZZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Adylkuzz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/adylkuzz"
        date = "2026-10-16"
    strings:
        $attrib_str = "adylkuzz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Aenjaris (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aenjaris
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AENJARIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aenjaris (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aenjaris"
        date = "2026-10-16"
    strings:
        $fam_name = "aenjaris" ascii wide nocase
        $alias_1 = "trojan:win32/aenjaris" ascii wide nocase
        $alias_2 = "trojan:win32/aenjaris.a" ascii wide nocase
        $alias_3 = "trojan:win32/aenjaris.b" ascii wide nocase
        $alias_4 = "win32/aenjaris" ascii wide nocase
        $alias_5 = "backdoor:win32/aenjaris" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AENJARIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aenjaris tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aenjaris"
        date = "2026-10-16"
    strings:
        $attrib_str = "aenjaris" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Aero (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aero
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AERO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aero (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aero"
        date = "2026-10-16"
    strings:
        $fam_name = "aero" ascii wide nocase
        $alias_1 = "aero sample" ascii wide nocase
        $alias_2 = "pup.aero" ascii wide nocase
        $alias_3 = "browsermodifier.aero" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AERO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aero tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aero"
        date = "2026-10-16"
    strings:
        $attrib_str = "aero" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Agen (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/agen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AGEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Agen (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agen"
        date = "2026-10-16"
    strings:
        $fam_name = "agen" ascii wide nocase
        $alias_1 = "trojan.agen" ascii wide nocase
        $alias_2 = "malware.agen" ascii wide nocase
        $alias_3 = "win32/trojan.generic" ascii wide nocase
        $alias_4 = "trojan:win32/agen" ascii wide nocase
        $alias_5 = "trojan.win32.agen" ascii wide nocase
        $alias_6 = "win32/agen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AGEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Agen tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agen"
        date = "2026-10-16"
    strings:
        $attrib_str = "agen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Agentb (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/agentb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AGENTB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Agentb (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agentb"
        date = "2026-10-16"
    strings:
        $fam_name = "agentb" ascii wide nocase
        $alias_1 = "trojan:win32/agent.b" ascii wide nocase
        $alias_2 = "trojan-downloader.win32.agent.b" ascii wide nocase
        $alias_3 = "backdoor.agent.b" ascii wide nocase
        $alias_4 = "win32/agent.b.downloader" ascii wide nocase
        $alias_5 = "trojan.agent.b" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AGENTB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Agentb tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agentb"
        date = "2026-10-16"
    strings:
        $attrib_str = "agentb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Agenttesla (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/agenttesla
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AGENTTESLA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Agenttesla (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agenttesla"
        date = "2026-10-16"
    strings:
        $fam_name = "agenttesla" ascii wide nocase
        $alias_1 = "agent tesla" ascii wide nocase
        $alias_2 = "agenttesla" ascii wide nocase
        $alias_3 = "infostealer.agenttesla" ascii wide nocase
        $alias_4 = "keylogger.agenttesla" ascii wide nocase
        $alias_5 = "msil/agenttesla" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AGENTTESLA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Agenttesla tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agenttesla"
        date = "2026-10-16"
    strings:
        $attrib_str = "agenttesla" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Agentus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/agentus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AGENTUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Agentus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agentus"
        date = "2026-10-16"
    strings:
        $fam_name = "agentus" ascii wide nocase
        $alias_1 = "ransom:win32/agentus" ascii wide nocase
        $alias_2 = "ransom.win32.agentus" ascii wide nocase
        $alias_3 = "win32/agentus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AGENTUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Agentus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agentus"
        date = "2026-10-16"
    strings:
        $attrib_str = "agentus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Agentwdcr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/agentwdcr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AGENTWDCR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Agentwdcr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agentwdcr"
        date = "2026-10-16"
    strings:
        $fam_name = "agentwdcr" ascii wide nocase
        $alias_1 = "ransom:win32/agentwdcr" ascii wide nocase
        $alias_2 = "ransom.win32.agentwdcr" ascii wide nocase
        $alias_3 = "win32/agentwdcr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AGENTWDCR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Agentwdcr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agentwdcr"
        date = "2026-10-16"
    strings:
        $attrib_str = "agentwdcr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Agiala (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/agiala
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AGIALA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Agiala (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agiala"
        date = "2026-10-16"
    strings:
        $fam_name = "agiala" ascii wide nocase
        $alias_1 = "trojan.agiala" ascii wide nocase
        $alias_2 = "downloader.agiala" ascii wide nocase
        $alias_3 = "win32/agiala" ascii wide nocase
        $alias_4 = "ransom:win32/agiala" ascii wide nocase
        $alias_5 = "ransom.win32.agiala" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AGIALA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Agiala tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agiala"
        date = "2026-10-16"
    strings:
        $attrib_str = "agiala" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Agile (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/agile
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AGILE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Agile (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agile"
        date = "2026-10-16"
    strings:
        $fam_name = "agile" ascii wide nocase
        $alias_1 = "ransom:win32/agile" ascii wide nocase
        $alias_2 = "ransom.win32.agile" ascii wide nocase
        $alias_3 = "win32/agile" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AGILE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Agile tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agile"
        date = "2026-10-16"
    strings:
        $attrib_str = "agile" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Agobot (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/agobot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AGOBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Agobot (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agobot"
        date = "2026-10-16"
    strings:
        $fam_name = "agobot" ascii wide nocase
        $alias_1 = "backdoor:win32/agobot" ascii wide nocase
        $alias_2 = "backdoor.win32.agobot" ascii wide nocase
        $alias_3 = "win32/agobot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AGOBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Agobot tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/agobot"
        date = "2026-10-16"
    strings:
        $attrib_str = "agobot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Aim_Downloader (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aim_downloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AIM_DOWNLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aim_Downloader (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aim_downloader"
        date = "2026-10-16"
    strings:
        $fam_name = "aim_downloader" ascii wide nocase
        $alias_1 = "downloader.aim" ascii wide nocase
        $alias_2 = "trojan.win32.aimdownloader" ascii wide nocase
        $alias_3 = "aim.exe trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AIM_DOWNLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aim_Downloader tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aim_downloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "aim_downloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ainslot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ainslot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AINSLOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ainslot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ainslot"
        date = "2026-10-16"
    strings:
        $fam_name = "ainslot" ascii wide nocase
        $alias_1 = "ainslot" ascii wide nocase
        $alias_2 = "trojan:win32/ainslot" ascii wide nocase
        $alias_3 = "worm:win32/ainslot.a" ascii wide nocase
        $alias_4 = "troj_gen.uae171y" ascii wide nocase
        $alias_5 = "win32/ainslot" ascii wide nocase
        $alias_6 = "trojan.ainslot" ascii wide nocase
        $alias_7 = "downloader.ainslot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AINSLOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ainslot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ainslot"
        date = "2026-10-16"
    strings:
        $attrib_str = "ainslot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Airinstaller (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/airinstaller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AIRINSTALLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Airinstaller (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/airinstaller"
        date = "2026-10-16"
    strings:
        $fam_name = "airinstaller" ascii wide nocase
        $alias_1 = "softwarebundler:win32/airinstaller" ascii wide nocase
        $alias_2 = "pua:win32/airinstaller" ascii wide nocase
        $alias_3 = "adware:win32/airinstaller" ascii wide nocase
        $alias_4 = "win32/airinstaller" ascii wide nocase
        $alias_5 = "airinstaller bundler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AIRINSTALLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Airinstaller tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/airinstaller"
        date = "2026-10-16"
    strings:
        $attrib_str = "airinstaller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Akcom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/akcom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AKCOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Akcom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/akcom"
        date = "2026-10-16"
    strings:
        $fam_name = "akcom" ascii wide nocase
        $alias_1 = "trojan.akcom" ascii wide nocase
        $alias_2 = "downloader.akcom" ascii wide nocase
        $alias_3 = "win32/akcom" ascii wide nocase
        $alias_4 = "ransom:win32/akcom" ascii wide nocase
        $alias_5 = "ransom.win32.akcom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AKCOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Akcom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/akcom"
        date = "2026-10-16"
    strings:
        $attrib_str = "akcom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Akely (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/akely
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AKELY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Akely (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/akely"
        date = "2026-10-16"
    strings:
        $fam_name = "akely" ascii wide nocase
        $alias_1 = "ransom:win32/akely" ascii wide nocase
        $alias_2 = "ransom.win32.akely" ascii wide nocase
        $alias_3 = "win32/akely" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AKELY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Akely tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/akely"
        date = "2026-10-16"
    strings:
        $attrib_str = "akely" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Aksula (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aksula
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AKSULA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aksula (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aksula"
        date = "2026-10-16"
    strings:
        $fam_name = "aksula" ascii wide nocase
        $alias_1 = "trojan.aksula" ascii wide nocase
        $alias_2 = "downloader.aksula" ascii wide nocase
        $alias_3 = "win32/aksula" ascii wide nocase
        $alias_4 = "ransom:win32/aksula" ascii wide nocase
        $alias_5 = "ransom.win32.aksula" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AKSULA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aksula tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aksula"
        date = "2026-10-16"
    strings:
        $attrib_str = "aksula" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Alien (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/alien
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALIEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Alien (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alien"
        date = "2026-10-16"
    strings:
        $fam_name = "alien" ascii wide nocase
        $alias_1 = "trojan:win32/alien" ascii wide nocase
        $alias_2 = "backdoor:win32/alien" ascii wide nocase
        $alias_3 = "win32/alien" ascii wide nocase
        $alias_4 = "trojan.alien" ascii wide nocase
        $alias_5 = "alienbot" ascii wide nocase
        $alias_6 = "alien android trojan" ascii wide nocase
        $alias_7 = "trojan-banker.androidos.alien" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALIEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Alien tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alien"
        date = "2026-10-16"
    strings:
        $attrib_str = "alien" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Alinaos (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/alinaos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALINAOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Alinaos (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alinaos"
        date = "2026-10-16"
    strings:
        $fam_name = "alinaos" ascii wide nocase
        $alias_1 = "trojan:win32/alinaos" ascii wide nocase
        $alias_2 = "trojan.win32.alinaos" ascii wide nocase
        $alias_3 = "win32/alinaos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALINAOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Alinaos tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alinaos"
        date = "2026-10-16"
    strings:
        $attrib_str = "alinaos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Aliser (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aliser
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALISER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aliser (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aliser"
        date = "2026-10-16"
    strings:
        $fam_name = "aliser" ascii wide nocase
        $alias_1 = "win32/aliser" ascii wide nocase
        $alias_2 = "virus:win32/aliser" ascii wide nocase
        $alias_3 = "aliser.7825" ascii wide nocase
        $alias_4 = "virus.win32.aliser" ascii wide nocase
        $alias_5 = "win32.aliser.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALISER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aliser tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aliser"
        date = "2026-10-16"
    strings:
        $attrib_str = "aliser" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Allaple (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/allaple
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALLAPLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Allaple (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/allaple"
        date = "2026-10-16"
    strings:
        $fam_name = "allaple" ascii wide nocase
        $alias_1 = "rahack" ascii wide nocase
        $alias_2 = "net-worm.win32.allaple" ascii wide nocase
        $alias_3 = "w32/allaple" ascii wide nocase
        $alias_4 = "worm.allaple" ascii wide nocase
        $alias_5 = "win32.allaple.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALLAPLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Allaple tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/allaple"
        date = "2026-10-16"
    strings:
        $attrib_str = "allaple" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Allinonekeylogger (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/allinonekeylogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALLINONEKEYLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Allinonekeylogger (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/allinonekeylogger"
        date = "2026-10-16"
    strings:
        $fam_name = "allinonekeylogger" ascii wide nocase
        $alias_1 = "pws:win32/allinonekeylogger" ascii wide nocase
        $alias_2 = "pws.win32.allinonekeylogger" ascii wide nocase
        $alias_3 = "win32/allinonekeylogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALLINONEKEYLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Allinonekeylogger tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/allinonekeylogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "allinonekeylogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Allstars (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/allstars
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALLSTARS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Allstars (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/allstars"
        date = "2026-10-16"
    strings:
        $fam_name = "allstars" ascii wide nocase
        $alias_1 = "trojan:win32/allstars" ascii wide nocase
        $alias_2 = "trojan.win32.allstars" ascii wide nocase
        $alias_3 = "win32/allstars" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALLSTARS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Allstars tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/allstars"
        date = "2026-10-16"
    strings:
        $attrib_str = "allstars" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Alman (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/alman
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALMAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Alman (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alman"
        date = "2026-10-16"
    strings:
        $fam_name = "alman" ascii wide nocase
        $alias_1 = "virus:win32/alman" ascii wide nocase
        $alias_2 = "almanahe" ascii wide nocase
        $alias_3 = "w32/alman" ascii wide nocase
        $alias_4 = "virus.win32.alman" ascii wide nocase
        $alias_5 = "win32/alman.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALMAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Alman tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alman"
        date = "2026-10-16"
    strings:
        $attrib_str = "alman" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Alnaddy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/alnaddy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALNADDY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Alnaddy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alnaddy"
        date = "2026-10-16"
    strings:
        $fam_name = "alnaddy" ascii wide nocase
        $alias_1 = "hijacker.alnaddy" ascii wide nocase
        $alias_2 = "adware.alnaddy" ascii wide nocase
        $alias_3 = "browsermodifier.alnaddy" ascii wide nocase
        $alias_4 = "trojan:win32/alnaddy" ascii wide nocase
        $alias_5 = "trojan.win32.alnaddy" ascii wide nocase
        $alias_6 = "win32/alnaddy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALNADDY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Alnaddy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alnaddy"
        date = "2026-10-16"
    strings:
        $attrib_str = "alnaddy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Alot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/alot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Alot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alot"
        date = "2026-10-16"
    strings:
        $fam_name = "alot" ascii wide nocase
        $alias_1 = "ransom:win32/alot" ascii wide nocase
        $alias_2 = "ransom.win32.alot" ascii wide nocase
        $alias_3 = "win32/alot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Alot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alot"
        date = "2026-10-16"
    strings:
        $attrib_str = "alot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Alphaeon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/alphaeon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALPHAEON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Alphaeon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alphaeon"
        date = "2026-10-16"
    strings:
        $fam_name = "alphaeon" ascii wide nocase
        $alias_1 = "ransom:win32/alphaeon" ascii wide nocase
        $alias_2 = "ransom.win32.alphaeon" ascii wide nocase
        $alias_3 = "win32/alphaeon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALPHAEON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Alphaeon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alphaeon"
        date = "2026-10-16"
    strings:
        $attrib_str = "alphaeon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Alreay (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/alreay
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALREAY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Alreay (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alreay"
        date = "2026-10-16"
    strings:
        $fam_name = "alreay" ascii wide nocase
        $alias_1 = "ransom:win32/alreay" ascii wide nocase
        $alias_2 = "ransom.win32.alreay" ascii wide nocase
        $alias_3 = "win32/alreay" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALREAY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Alreay tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alreay"
        date = "2026-10-16"
    strings:
        $attrib_str = "alreay" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Alvabrig (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/alvabrig
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALVABRIG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Alvabrig (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alvabrig"
        date = "2026-10-16"
    strings:
        $fam_name = "alvabrig" ascii wide nocase
        $alias_1 = "trojan.alvabrig" ascii wide nocase
        $alias_2 = "adware.alvabrig" ascii wide nocase
        $alias_3 = "win32/alvabrig" ascii wide nocase
        $alias_4 = "ransom:win32/alvabrig" ascii wide nocase
        $alias_5 = "ransom.win32.alvabrig" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALVABRIG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Alvabrig tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alvabrig"
        date = "2026-10-16"
    strings:
        $attrib_str = "alvabrig" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Alyak (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/alyak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ALYAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Alyak (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alyak"
        date = "2026-10-16"
    strings:
        $fam_name = "alyak" ascii wide nocase
        $alias_1 = "pup.alyak" ascii wide nocase
        $alias_2 = "adware.alyak" ascii wide nocase
        $alias_3 = "generic.alyak" ascii wide nocase
        $alias_4 = "trojan:win32/alyak" ascii wide nocase
        $alias_5 = "trojan.win32.alyak" ascii wide nocase
        $alias_6 = "win32/alyak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ALYAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Alyak tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/alyak"
        date = "2026-10-16"
    strings:
        $attrib_str = "alyak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Amavaldo (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/amavaldo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AMAVALDO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Amavaldo (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amavaldo"
        date = "2026-10-16"
    strings:
        $fam_name = "amavaldo" ascii wide nocase
        $alias_1 = "trojan:win32/amavaldo" ascii wide nocase
        $alias_2 = "trojan.win32.amavaldo" ascii wide nocase
        $alias_3 = "win32/amavaldo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AMAVALDO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Amavaldo tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amavaldo"
        date = "2026-10-16"
    strings:
        $attrib_str = "amavaldo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Amber (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/amber
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AMBER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Amber (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amber"
        date = "2026-10-16"
    strings:
        $fam_name = "amber" ascii wide nocase
        $alias_1 = "ransom.amber" ascii wide nocase
        $alias_2 = "win32/filecoder.amber" ascii wide nocase
        $alias_3 = "trojan-ransom.win32.amber" ascii wide nocase
        $alias_4 = "ransom:win32/amber" ascii wide nocase
        $alias_5 = "ransom.win32.amber" ascii wide nocase
        $alias_6 = "win32/amber" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AMBER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Amber tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amber"
        date = "2026-10-16"
    strings:
        $attrib_str = "amber" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Amdocssims (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/amdocssims
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AMDOCSSIMS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Amdocssims (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amdocssims"
        date = "2026-10-16"
    strings:
        $fam_name = "amdocssims" ascii wide nocase
        $alias_1 = "riskware.amdocssims" ascii wide nocase
        $alias_2 = "hacktool.telecom" ascii wide nocase
        $alias_3 = "pup.amdocs" ascii wide nocase
        $alias_4 = "trojan:win32/amdocssims" ascii wide nocase
        $alias_5 = "trojan.win32.amdocssims" ascii wide nocase
        $alias_6 = "win32/amdocssims" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AMDOCSSIMS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Amdocssims tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amdocssims"
        date = "2026-10-16"
    strings:
        $attrib_str = "amdocssims" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Amgfaohk2Uf (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/amgfaohk2uf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AMGFAOHK2UF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Amgfaohk2Uf (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amgfaohk2uf"
        date = "2026-10-16"
    strings:
        $fam_name = "amgfaohk2uf" ascii wide nocase
        $alias_1 = "trojan.obfuscated.gen" ascii wide nocase
        $alias_2 = "dropper.randomname" ascii wide nocase
        $alias_3 = "win32/trojan.packer" ascii wide nocase
        $alias_4 = "ransom:win32/amgfaohk2uf" ascii wide nocase
        $alias_5 = "ransom.win32.amgfaohk2uf" ascii wide nocase
        $alias_6 = "win32/amgfaohk2uf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AMGFAOHK2UF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Amgfaohk2Uf tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amgfaohk2uf"
        date = "2026-10-16"
    strings:
        $attrib_str = "amgfaohk2uf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Amgfvjgvdoaan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/amgfvjgvdoaan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AMGFVJGVDOAAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Amgfvjgvdoaan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amgfvjgvdoaan"
        date = "2026-10-16"
    strings:
        $fam_name = "amgfvjgvdoaan" ascii wide nocase
        $alias_1 = "ransom:win32/amgfvjgvdoaan" ascii wide nocase
        $alias_2 = "ransom.win32.amgfvjgvdoaan" ascii wide nocase
        $alias_3 = "win32/amgfvjgvdoaan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AMGFVJGVDOAAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Amgfvjgvdoaan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amgfvjgvdoaan"
        date = "2026-10-16"
    strings:
        $attrib_str = "amgfvjgvdoaan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Amiboide (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/amiboide
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AMIBOIDE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Amiboide (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amiboide"
        date = "2026-10-16"
    strings:
        $fam_name = "amiboide" ascii wide nocase
        $alias_1 = "amiboide" ascii wide nocase
        $alias_2 = "trojan.amiboide" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AMIBOIDE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Amiboide tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amiboide"
        date = "2026-10-16"
    strings:
        $attrib_str = "amiboide" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Ammyy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ammyy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AMMYY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ammyy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ammyy"
        date = "2026-10-16"
    strings:
        $fam_name = "ammyy" ascii wide nocase
        $alias_1 = "ransom:win32/ammyy" ascii wide nocase
        $alias_2 = "ransom.win32.ammyy" ascii wide nocase
        $alias_3 = "win32/ammyy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AMMYY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ammyy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ammyy"
        date = "2026-10-16"
    strings:
        $attrib_str = "ammyy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Amnesia (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/amnesia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AMNESIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Amnesia (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amnesia"
        date = "2026-10-16"
    strings:
        $fam_name = "amnesia" ascii wide nocase
        $alias_1 = "ransomware.amnesia" ascii wide nocase
        $alias_2 = "linux.amnesia" ascii wide nocase
        $alias_3 = "botnet.amnesia" ascii wide nocase
        $alias_4 = "troj/amnesia" ascii wide nocase
        $alias_5 = "ransom:win32/amnesia" ascii wide nocase
        $alias_6 = "ransom.win32.amnesia" ascii wide nocase
        $alias_7 = "win32/amnesia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AMNESIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Amnesia tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amnesia"
        date = "2026-10-16"
    strings:
        $attrib_str = "amnesia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Amonetize (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/amonetize
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AMONETIZE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Amonetize (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amonetize"
        date = "2026-10-16"
    strings:
        $fam_name = "amonetize" ascii wide nocase
        $alias_1 = "pua:win32/amonetize" ascii wide nocase
        $alias_2 = "softwarebundler:win32/amonetize" ascii wide nocase
        $alias_3 = "adware.amonetize" ascii wide nocase
        $alias_4 = "win32/amonetize" ascii wide nocase
        $alias_5 = "amonetize installer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AMONETIZE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Amonetize tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amonetize"
        date = "2026-10-16"
    strings:
        $attrib_str = "amonetize" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Amtgimon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/amtgimon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AMTGIMON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Amtgimon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amtgimon"
        date = "2026-10-16"
    strings:
        $fam_name = "amtgimon" ascii wide nocase
        $alias_1 = "trojan.amtgimon" ascii wide nocase
        $alias_2 = "downloader.amtgimon" ascii wide nocase
        $alias_3 = "win32/amtgimon" ascii wide nocase
        $alias_4 = "ransom:win32/amtgimon" ascii wide nocase
        $alias_5 = "ransom.win32.amtgimon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AMTGIMON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Amtgimon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/amtgimon"
        date = "2026-10-16"
    strings:
        $attrib_str = "amtgimon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Animus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/animus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ANIMUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Animus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/animus"
        date = "2026-10-16"
    strings:
        $fam_name = "animus" ascii wide nocase
        $alias_1 = "trojan.animus" ascii wide nocase
        $alias_2 = "downloader.animus" ascii wide nocase
        $alias_3 = "win32/animus" ascii wide nocase
        $alias_4 = "ransom:win32/animus" ascii wide nocase
        $alias_5 = "ransom.win32.animus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ANIMUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Animus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/animus"
        date = "2026-10-16"
    strings:
        $attrib_str = "animus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Anprot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/anprot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ANPROT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Anprot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/anprot"
        date = "2026-10-16"
    strings:
        $fam_name = "anprot" ascii wide nocase
        $alias_1 = "trojan.anprot" ascii wide nocase
        $alias_2 = "downloader.anprot" ascii wide nocase
        $alias_3 = "win32/anprot" ascii wide nocase
        $alias_4 = "ransom:win32/anprot" ascii wide nocase
        $alias_5 = "ransom.win32.anprot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ANPROT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Anprot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/anprot"
        date = "2026-10-16"
    strings:
        $attrib_str = "anprot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Anserin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/anserin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ANSERIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Anserin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/anserin"
        date = "2026-10-16"
    strings:
        $fam_name = "anserin" ascii wide nocase
        $alias_1 = "adware.anserin" ascii wide nocase
        $alias_2 = "pup.anserin" ascii wide nocase
        $alias_3 = "browsermodifier:win32/anserin" ascii wide nocase
        $alias_4 = "ransom:win32/anserin" ascii wide nocase
        $alias_5 = "ransom.win32.anserin" ascii wide nocase
        $alias_6 = "win32/anserin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ANSERIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Anserin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/anserin"
        date = "2026-10-16"
    strings:
        $attrib_str = "anserin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Antavmu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/antavmu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ANTAVMU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Antavmu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/antavmu"
        date = "2026-10-16"
    strings:
        $fam_name = "antavmu" ascii wide nocase
        $alias_1 = "ransom:win32/antavmu" ascii wide nocase
        $alias_2 = "ransom.win32.antavmu" ascii wide nocase
        $alias_3 = "win32/antavmu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ANTAVMU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Antavmu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/antavmu"
        date = "2026-10-16"
    strings:
        $attrib_str = "antavmu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Antidenial (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/antidenial
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ANTIDENIAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Antidenial (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/antidenial"
        date = "2026-10-16"
    strings:
        $fam_name = "antidenial" ascii wide nocase
        $alias_1 = "hacktool.dos.antidenial" ascii wide nocase
        $alias_2 = "dos.tool" ascii wide nocase
        $alias_3 = "win32/antidenial" ascii wide nocase
        $alias_4 = "trojan:win32/antidenial" ascii wide nocase
        $alias_5 = "trojan.win32.antidenial" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ANTIDENIAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Antidenial tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/antidenial"
        date = "2026-10-16"
    strings:
        $attrib_str = "antidenial" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Antisandbox (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/antisandbox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ANTISANDBOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Antisandbox (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/antisandbox"
        date = "2026-10-16"
    strings:
        $fam_name = "antisandbox" ascii wide nocase
        $alias_1 = "generic.antisandbox" ascii wide nocase
        $alias_2 = "trojan.evas" ascii wide nocase
        $alias_3 = "riskware.antivm" ascii wide nocase
        $alias_4 = "ransom:win32/antisandbox" ascii wide nocase
        $alias_5 = "ransom.win32.antisandbox" ascii wide nocase
        $alias_6 = "win32/antisandbox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ANTISANDBOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Antisandbox tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/antisandbox"
        date = "2026-10-16"
    strings:
        $attrib_str = "antisandbox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Antivirus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/antivirus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ANTIVIRUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Antivirus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/antivirus"
        date = "2026-10-16"
    strings:
        $fam_name = "antivirus" ascii wide nocase
        $alias_1 = "fakeav" ascii wide nocase
        $alias_2 = "rogue.antivirus" ascii wide nocase
        $alias_3 = "scareware" ascii wide nocase
        $alias_4 = "ransom:win32/antivirus" ascii wide nocase
        $alias_5 = "ransom.win32.antivirus" ascii wide nocase
        $alias_6 = "win32/antivirus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ANTIVIRUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Antivirus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/antivirus"
        date = "2026-10-16"
    strings:
        $attrib_str = "antivirus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Anyprotect (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/anyprotect
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ANYPROTECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Anyprotect (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/anyprotect"
        date = "2026-10-16"
    strings:
        $fam_name = "anyprotect" ascii wide nocase
        $alias_1 = "trojan:win32/anyprotect" ascii wide nocase
        $alias_2 = "trojan.win32.anyprotect" ascii wide nocase
        $alias_3 = "win32/anyprotect" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ANYPROTECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Anyprotect tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/anyprotect"
        date = "2026-10-16"
    strings:
        $attrib_str = "anyprotect" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Aotoit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aotoit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AOTOIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aotoit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aotoit"
        date = "2026-10-16"
    strings:
        $fam_name = "aotoit" ascii wide nocase
        $alias_1 = "ransom:win32/aotoit" ascii wide nocase
        $alias_2 = "ransom.win32.aotoit" ascii wide nocase
        $alias_3 = "win32/aotoit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AOTOIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aotoit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aotoit"
        date = "2026-10-16"
    strings:
        $attrib_str = "aotoit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Apocalypse (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/apocalypse
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_APOCALYPSE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Apocalypse (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/apocalypse"
        date = "2026-10-16"
    strings:
        $fam_name = "apocalypse" ascii wide nocase
        $alias_1 = "ransom.apocalypse" ascii wide nocase
        $alias_2 = "win32/apocalypse" ascii wide nocase
        $alias_3 = "trojan-ransom.win32.apocalypse" ascii wide nocase
        $alias_4 = "ransom:win32/apocalypse" ascii wide nocase
        $alias_5 = "ransom.win32.apocalypse" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_APOCALYPSE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Apocalypse tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/apocalypse"
        date = "2026-10-16"
    strings:
        $attrib_str = "apocalypse" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Apocalypse_Rat (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/apocalypse_rat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_APOCALYPSE_RAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Apocalypse_Rat (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/apocalypse_rat"
        date = "2026-10-16"
    strings:
        $fam_name = "apocalypse_rat" ascii wide nocase
        $alias_1 = "apocrat" ascii wide nocase
        $alias_2 = "apocalypse rat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_APOCALYPSE_RAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Apocalypse_Rat tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/apocalypse_rat"
        date = "2026-10-16"
    strings:
        $attrib_str = "apocalypse_rat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Apost (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/apost
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_APOST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Apost (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/apost"
        date = "2026-10-16"
    strings:
        $fam_name = "apost" ascii wide nocase
        $alias_1 = "trojan:win32/apost" ascii wide nocase
        $alias_2 = "trojan.win32.apost" ascii wide nocase
        $alias_3 = "backdoor:win32/apost" ascii wide nocase
        $alias_4 = "spyware.win32.apost" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_APOST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Apost tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/apost"
        date = "2026-10-16"
    strings:
        $attrib_str = "apost" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Appscience (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/appscience
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_APPSCIENCE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Appscience (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/appscience"
        date = "2026-10-16"
    strings:
        $fam_name = "appscience" ascii wide nocase
        $alias_1 = "adware:win32/appscience" ascii wide nocase
        $alias_2 = "pua:win32/appscience" ascii wide nocase
        $alias_3 = "appscience adware" ascii wide nocase
        $alias_4 = "program:win32/appscience" ascii wide nocase
        $alias_5 = "win32/appscience" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_APPSCIENCE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Appscience tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/appscience"
        date = "2026-10-16"
    strings:
        $attrib_str = "appscience" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Appset (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/appset
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_APPSET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Appset (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/appset"
        date = "2026-10-16"
    strings:
        $fam_name = "appset" ascii wide nocase
        $alias_1 = "pua:win32/appset" ascii wide nocase
        $alias_2 = "trojan:win32/appset" ascii wide nocase
        $alias_3 = "program:win32/appset" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_APPSET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Appset tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/appset"
        date = "2026-10-16"
    strings:
        $attrib_str = "appset" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Appster (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/appster
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_APPSTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Appster (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/appster"
        date = "2026-10-16"
    strings:
        $fam_name = "appster" ascii wide nocase
        $alias_1 = "adware:win32/appster" ascii wide nocase
        $alias_2 = "pua:win32/appster" ascii wide nocase
        $alias_3 = "adware.appster.bundler" ascii wide nocase
        $alias_4 = "win32/appster.installer" ascii wide nocase
        $alias_5 = "pup.optional.appster" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_APPSTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Appster tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/appster"
        date = "2026-10-16"
    strings:
        $attrib_str = "appster" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Apropos (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/apropos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_APROPOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Apropos (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/apropos"
        date = "2026-10-16"
    strings:
        $fam_name = "apropos" ascii wide nocase
        $alias_1 = "osx.apropos" ascii wide nocase
        $alias_2 = "adware.mac.apropos" ascii wide nocase
        $alias_3 = "pup.apropos" ascii wide nocase
        $alias_4 = "trojan:win32/apropos" ascii wide nocase
        $alias_5 = "trojan.win32.apropos" ascii wide nocase
        $alias_6 = "win32/apropos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_APROPOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Apropos tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/apropos"
        date = "2026-10-16"
    strings:
        $attrib_str = "apropos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Aque (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aque
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AQUE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aque (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aque"
        date = "2026-10-16"
    strings:
        $fam_name = "aque" ascii wide nocase
        $alias_1 = "ransom:win32/aque" ascii wide nocase
        $alias_2 = "ransom.win32.aque" ascii wide nocase
        $alias_3 = "win32/aque" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AQUE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aque tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aque"
        date = "2026-10-16"
    strings:
        $attrib_str = "aque" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Arcdoor (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/arcdoor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ARCDOOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Arcdoor (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/arcdoor"
        date = "2026-10-16"
    strings:
        $fam_name = "arcdoor" ascii wide nocase
        $alias_1 = "backdoor:win32/arcdoor" ascii wide nocase
        $alias_2 = "backdoor.win32.arcdoor" ascii wide nocase
        $alias_3 = "win32/arcdoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ARCDOOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Arcdoor tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/arcdoor"
        date = "2026-10-16"
    strings:
        $attrib_str = "arcdoor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Archsms (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/archsms
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ARCHSMS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Archsms (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/archsms"
        date = "2026-10-16"
    strings:
        $fam_name = "archsms" ascii wide nocase
        $alias_1 = "hoax.win32.archsms" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.archsms" ascii wide nocase
        $alias_3 = "trojan:win32/archsms" ascii wide nocase
        $alias_4 = "ransom:win32/archsms" ascii wide nocase
        $alias_5 = "win32/archsms" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ARCHSMS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Archsms tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/archsms"
        date = "2026-10-16"
    strings:
        $attrib_str = "archsms" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ardamax (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ardamax
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ARDAMAX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ardamax (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ardamax"
        date = "2026-10-16"
    strings:
        $fam_name = "ardamax" ascii wide nocase
        $alias_1 = "ardamax" ascii wide nocase
        $alias_2 = "ardamax keylogger" ascii wide nocase
        $alias_3 = "pws:win32/ardamax" ascii wide nocase
        $alias_4 = "trojan.ardamax" ascii wide nocase
        $alias_5 = "spyware.ardamax" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ARDAMAX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ardamax tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ardamax"
        date = "2026-10-16"
    strings:
        $attrib_str = "ardamax" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ardurk (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ardurk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ARDURK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ardurk (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ardurk"
        date = "2026-10-16"
    strings:
        $fam_name = "ardurk" ascii wide nocase
        $alias_1 = "ransom:win32/ardurk" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.ardurk" ascii wide nocase
        $alias_3 = "win32/ardurk" ascii wide nocase
        $alias_4 = "ransom.ardurk" ascii wide nocase
        $alias_5 = "ardurk ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ARDURK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ardurk tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ardurk"
        date = "2026-10-16"
    strings:
        $attrib_str = "ardurk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Arhost (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/arhost
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ARHOST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Arhost (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/arhost"
        date = "2026-10-16"
    strings:
        $fam_name = "arhost" ascii wide nocase
        $alias_1 = "ransom:win32/arhost" ascii wide nocase
        $alias_2 = "ransom.win32.arhost" ascii wide nocase
        $alias_3 = "win32/arhost" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ARHOST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Arhost tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/arhost"
        date = "2026-10-16"
    strings:
        $attrib_str = "arhost" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Arkeistealer (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/arkeistealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ARKEISTEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Arkeistealer (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/arkeistealer"
        date = "2026-10-16"
    strings:
        $fam_name = "arkeistealer" ascii wide nocase
        $alias_1 = "pws:win32/arkeistealer" ascii wide nocase
        $alias_2 = "pws.win32.arkeistealer" ascii wide nocase
        $alias_3 = "win32/arkeistealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ARKEISTEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Arkeistealer tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/arkeistealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "arkeistealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Arload (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/arload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ARLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Arload (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/arload"
        date = "2026-10-16"
    strings:
        $fam_name = "arload" ascii wide nocase
        $alias_1 = "ransom:win32/arload" ascii wide nocase
        $alias_2 = "ransom.win32.arload" ascii wide nocase
        $alias_3 = "win32/arload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ARLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Arload tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/arload"
        date = "2026-10-16"
    strings:
        $attrib_str = "arload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Armadillo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/armadillo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ARMADILLO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Armadillo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/armadillo"
        date = "2026-10-16"
    strings:
        $fam_name = "armadillo" ascii wide nocase
        $alias_1 = "ransom:win32/armadillo" ascii wide nocase
        $alias_2 = "ransom.win32.armadillo" ascii wide nocase
        $alias_3 = "win32/armadillo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ARMADILLO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Armadillo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/armadillo"
        date = "2026-10-16"
    strings:
        $attrib_str = "armadillo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Artel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/artel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ARTEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Artel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/artel"
        date = "2026-10-16"
    strings:
        $fam_name = "artel" ascii wide nocase
        $alias_1 = "ransom:win32/artel" ascii wide nocase
        $alias_2 = "ransom.win32.artel" ascii wide nocase
        $alias_3 = "win32/artel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ARTEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Artel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/artel"
        date = "2026-10-16"
    strings:
        $attrib_str = "artel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Aseye (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aseye
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ASEYE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aseye (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aseye"
        date = "2026-10-16"
    strings:
        $fam_name = "aseye" ascii wide nocase
        $alias_1 = "trojan.aseye" ascii wide nocase
        $alias_2 = "downloader.aseye" ascii wide nocase
        $alias_3 = "win32/aseye" ascii wide nocase
        $alias_4 = "ransom:win32/aseye" ascii wide nocase
        $alias_5 = "ransom.win32.aseye" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ASEYE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aseye tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aseye"
        date = "2026-10-16"
    strings:
        $attrib_str = "aseye" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Asianraw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/asianraw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ASIANRAW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Asianraw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/asianraw"
        date = "2026-10-16"
    strings:
        $fam_name = "asianraw" ascii wide nocase
        $alias_1 = "trojan.asianraw" ascii wide nocase
        $alias_2 = "downloader.asianraw" ascii wide nocase
        $alias_3 = "win32/asianraw" ascii wide nocase
        $alias_4 = "ransom:win32/asianraw" ascii wide nocase
        $alias_5 = "ransom.win32.asianraw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ASIANRAW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Asianraw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/asianraw"
        date = "2026-10-16"
    strings:
        $attrib_str = "asianraw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Asktoolbar (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/asktoolbar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ASKTOOLBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Asktoolbar (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/asktoolbar"
        date = "2026-10-16"
    strings:
        $fam_name = "asktoolbar" ascii wide nocase
        $alias_1 = "browsermodifier:win32/asktoolbar" ascii wide nocase
        $alias_2 = "adware:win32/asktoolbar" ascii wide nocase
        $alias_3 = "pua:win32/askpartnernetwork" ascii wide nocase
        $alias_4 = "toolbar:win32/ask" ascii wide nocase
        $alias_5 = "win32/asktoolbar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ASKTOOLBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Asktoolbar tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/asktoolbar"
        date = "2026-10-16"
    strings:
        $attrib_str = "asktoolbar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Asparnet (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/asparnet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ASPARNET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Asparnet (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/asparnet"
        date = "2026-10-16"
    strings:
        $fam_name = "asparnet" ascii wide nocase
        $alias_1 = "trojan:win32/asparnet" ascii wide nocase
        $alias_2 = "adware:win32/asparnet" ascii wide nocase
        $alias_3 = "win32/asparnet" ascii wide nocase
        $alias_4 = "trojan.asparnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ASPARNET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Asparnet tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/asparnet"
        date = "2026-10-16"
    strings:
        $attrib_str = "asparnet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Aspm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aspm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ASPM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aspm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aspm"
        date = "2026-10-16"
    strings:
        $fam_name = "aspm" ascii wide nocase
        $alias_1 = "ransom:win32/aspm" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.aspm" ascii wide nocase
        $alias_3 = "win32/aspm" ascii wide nocase
        $alias_4 = "ransom.aspm" ascii wide nocase
        $alias_5 = "aspm ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ASPM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aspm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aspm"
        date = "2026-10-16"
    strings:
        $attrib_str = "aspm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Aspxor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/aspxor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ASPXOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Aspxor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aspxor"
        date = "2026-10-16"
    strings:
        $fam_name = "aspxor" ascii wide nocase
        $alias_1 = "trojan:win32/aspxor" ascii wide nocase
        $alias_2 = "trojan.win32.aspxor" ascii wide nocase
        $alias_3 = "win32/aspxor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ASPXOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Aspxor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/aspxor"
        date = "2026-10-16"
    strings:
        $attrib_str = "aspxor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Asym (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/asym
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ASYM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Asym (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/asym"
        date = "2026-10-16"
    strings:
        $fam_name = "asym" ascii wide nocase
        $alias_1 = "trojan.asym" ascii wide nocase
        $alias_2 = "downloader.asym" ascii wide nocase
        $alias_3 = "win32/asym" ascii wide nocase
        $alias_4 = "ransom:win32/asym" ascii wide nocase
        $alias_5 = "ransom.win32.asym" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ASYM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Asym tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/asym"
        date = "2026-10-16"
    strings:
        $attrib_str = "asym" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Atmrod (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/atmrod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ATMROD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Atmrod (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atmrod"
        date = "2026-10-16"
    strings:
        $fam_name = "atmrod" ascii wide nocase
        $alias_1 = "trojan.atmrod" ascii wide nocase
        $alias_2 = "downloader.atmrod" ascii wide nocase
        $alias_3 = "win32/atmrod" ascii wide nocase
        $alias_4 = "ransom:win32/atmrod" ascii wide nocase
        $alias_5 = "ransom.win32.atmrod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ATMROD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Atmrod tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atmrod"
        date = "2026-10-16"
    strings:
        $attrib_str = "atmrod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Atmulator (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/atmulator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ATMULATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Atmulator (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atmulator"
        date = "2026-10-16"
    strings:
        $fam_name = "atmulator" ascii wide nocase
        $alias_1 = "trojan.atmulator" ascii wide nocase
        $alias_2 = "downloader.atmulator" ascii wide nocase
        $alias_3 = "win32/atmulator" ascii wide nocase
        $alias_4 = "ransom:win32/atmulator" ascii wide nocase
        $alias_5 = "ransom.win32.atmulator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ATMULATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Atmulator tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atmulator"
        date = "2026-10-16"
    strings:
        $attrib_str = "atmulator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Atom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/atom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ATOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Atom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atom"
        date = "2026-10-16"
    strings:
        $fam_name = "atom" ascii wide nocase
        $alias_1 = "trojan.atombombing" ascii wide nocase
        $alias_2 = "ransomware.atom" ascii wide nocase
        $alias_3 = "win32/atom" ascii wide nocase
        $alias_4 = "ransom:win32/atom" ascii wide nocase
        $alias_5 = "ransom.win32.atom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ATOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Atom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atom"
        date = "2026-10-16"
    strings:
        $attrib_str = "atom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Atomicrat (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/atomicrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ATOMICRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Atomicrat (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atomicrat"
        date = "2026-10-16"
    strings:
        $fam_name = "atomicrat" ascii wide nocase
        $alias_1 = "osx.atomicrat" ascii wide nocase
        $alias_2 = "trojan.atomic" ascii wide nocase
        $alias_3 = "backdoor.atomicrat" ascii wide nocase
        $alias_4 = "backdoor:win32/atomicrat" ascii wide nocase
        $alias_5 = "backdoor.win32.atomicrat" ascii wide nocase
        $alias_6 = "win32/atomicrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ATOMICRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Atomicrat tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atomicrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "atomicrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Atomix (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/atomix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ATOMIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Atomix (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atomix"
        date = "2026-10-16"
    strings:
        $fam_name = "atomix" ascii wide nocase
        $alias_1 = "trojan.atomix" ascii wide nocase
        $alias_2 = "downloader.atomix" ascii wide nocase
        $alias_3 = "win32/atomix" ascii wide nocase
        $alias_4 = "ransom:win32/atomix" ascii wide nocase
        $alias_5 = "ransom.win32.atomix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ATOMIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Atomix tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atomix"
        date = "2026-10-16"
    strings:
        $attrib_str = "atomix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Atraps (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/atraps
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ATRAPS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Atraps (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atraps"
        date = "2026-10-16"
    strings:
        $fam_name = "atraps" ascii wide nocase
        $alias_1 = "pws:win32/atraps" ascii wide nocase
        $alias_2 = "trojanspy:win32/atraps" ascii wide nocase
        $alias_3 = "trojan.win32.atraps" ascii wide nocase
        $alias_4 = "win32/atraps" ascii wide nocase
        $alias_5 = "spyware.atraps" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ATRAPS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Atraps tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/atraps"
        date = "2026-10-16"
    strings:
        $attrib_str = "atraps" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Attack (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/attack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ATTACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Attack (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/attack"
        date = "2026-10-16"
    strings:
        $fam_name = "attack" ascii wide nocase
        $alias_1 = "trojan:win32/attack" ascii wide nocase
        $alias_2 = "hacktool:win32/attack" ascii wide nocase
        $alias_3 = "win32/attack" ascii wide nocase
        $alias_4 = "attack lateral tool" ascii wide nocase
        $alias_5 = "trojan.attack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ATTACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Attack tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/attack"
        date = "2026-10-16"
    strings:
        $attrib_str = "attack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ausiv (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ausiv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUSIV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ausiv (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ausiv"
        date = "2026-10-16"
    strings:
        $fam_name = "ausiv" ascii wide nocase
        $alias_1 = "trojan:win32/ausiv" ascii wide nocase
        $alias_2 = "worm:win32/ausiv" ascii wide nocase
        $alias_3 = "trojan.win32.ausiv" ascii wide nocase
        $alias_4 = "win32/ausiv.a" ascii wide nocase
        $alias_5 = "ausiv.worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUSIV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ausiv tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ausiv"
        date = "2026-10-16"
    strings:
        $attrib_str = "ausiv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Auslogics (Rogueware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/auslogics
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUSLOGICS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Auslogics (Rogueware)"
        category = "Rogueware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/auslogics"
        date = "2026-10-16"
    strings:
        $fam_name = "auslogics" ascii wide nocase
        $alias_1 = "pua:win32/auslogics" ascii wide nocase
        $alias_2 = "pup.optional.auslogics" ascii wide nocase
        $alias_3 = "program:win32/auslogics" ascii wide nocase
        $alias_4 = "pua:win32/auslogicsboostspeed" ascii wide nocase
        $alias_5 = "pup.optional.auslogicsboostspeed" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUSLOGICS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Auslogics tradecraft"
        category = "Rogueware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/auslogics"
        date = "2026-10-16"
    strings:
        $attrib_str = "auslogics" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Autit (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/autit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUTIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Autit (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autit"
        date = "2026-10-16"
    strings:
        $fam_name = "autit" ascii wide nocase
        $alias_1 = "trojan:win32/autit" ascii wide nocase
        $alias_2 = "trojan.win32.autit" ascii wide nocase
        $alias_3 = "win32/autit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUTIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Autit tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autit"
        date = "2026-10-16"
    strings:
        $attrib_str = "autit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Autocleanpro (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/autocleanpro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUTOCLEANPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Autocleanpro (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autocleanpro"
        date = "2026-10-16"
    strings:
        $fam_name = "autocleanpro" ascii wide nocase
        $alias_1 = "trojan:win32/autocleanpro" ascii wide nocase
        $alias_2 = "trojan.win32.autocleanpro" ascii wide nocase
        $alias_3 = "win32/autocleanpro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUTOCLEANPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Autocleanpro tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autocleanpro"
        date = "2026-10-16"
    strings:
        $attrib_str = "autocleanpro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Autofixerpro (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/autofixerpro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUTOFIXERPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Autofixerpro (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autofixerpro"
        date = "2026-10-16"
    strings:
        $fam_name = "autofixerpro" ascii wide nocase
        $alias_1 = "adware:win32/autofixerpro" ascii wide nocase
        $alias_2 = "adware.win32.autofixerpro" ascii wide nocase
        $alias_3 = "win32/autofixerpro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUTOFIXERPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Autofixerpro tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autofixerpro"
        date = "2026-10-16"
    strings:
        $attrib_str = "autofixerpro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Autohit (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/autohit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUTOHIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Autohit (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autohit"
        date = "2026-10-16"
    strings:
        $fam_name = "autohit" ascii wide nocase
        $alias_1 = "trojan:win32/autohit" ascii wide nocase
        $alias_2 = "trojan.win32.autohit" ascii wide nocase
        $alias_3 = "win32/autohit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUTOHIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Autohit tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autohit"
        date = "2026-10-16"
    strings:
        $attrib_str = "autohit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Autohk (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/autohk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUTOHK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Autohk (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autohk"
        date = "2026-10-16"
    strings:
        $fam_name = "autohk" ascii wide nocase
        $alias_1 = "autohotkey.trojan" ascii wide nocase
        $alias_2 = "trojan.autohk" ascii wide nocase
        $alias_3 = "win32/autohk" ascii wide nocase
        $alias_4 = "ahk.stealer" ascii wide nocase
        $alias_5 = "malware.autohk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUTOHK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Autohk tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autohk"
        date = "2026-10-16"
    strings:
        $attrib_str = "autohk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Autoit (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/autoit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUTOIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Autoit (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autoit"
        date = "2026-10-16"
    strings:
        $fam_name = "autoit" ascii wide nocase
        $alias_1 = "trojan:win32/autoit" ascii wide nocase
        $alias_2 = "packer:win32/autoit" ascii wide nocase
        $alias_3 = "backdoor.autoit" ascii wide nocase
        $alias_4 = "win32/autoit.packer" ascii wide nocase
        $alias_5 = "autoit3.dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUTOIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Autoit tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autoit"
        date = "2026-10-16"
    strings:
        $attrib_str = "autoit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Autoitscript (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/autoitscript
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUTOITSCRIPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Autoitscript (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autoitscript"
        date = "2026-10-16"
    strings:
        $fam_name = "autoitscript" ascii wide nocase
        $alias_1 = "trojan:win32/autoitscript" ascii wide nocase
        $alias_2 = "trojan.win32.autoitscript" ascii wide nocase
        $alias_3 = "win32/autoitscript" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUTOITSCRIPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Autoitscript tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autoitscript"
        date = "2026-10-16"
    strings:
        $attrib_str = "autoitscript" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Autophyte (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/autophyte
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUTOPHYTE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Autophyte (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autophyte"
        date = "2026-10-16"
    strings:
        $fam_name = "autophyte" ascii wide nocase
        $alias_1 = "macro.word.autophyte" ascii wide nocase
        $alias_2 = "w97m.autophyte" ascii wide nocase
        $alias_3 = "virus.msword.autophyte" ascii wide nocase
        $alias_4 = "trojan:win32/autophyte" ascii wide nocase
        $alias_5 = "trojan.win32.autophyte" ascii wide nocase
        $alias_6 = "win32/autophyte" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUTOPHYTE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Autophyte tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autophyte"
        date = "2026-10-16"
    strings:
        $attrib_str = "autophyte" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Autorunerent (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/autorunerent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUTORUNERENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Autorunerent (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autorunerent"
        date = "2026-10-16"
    strings:
        $fam_name = "autorunerent" ascii wide nocase
        $alias_1 = "trojan:win32/autorunerent" ascii wide nocase
        $alias_2 = "trojan.win32.autorunerent" ascii wide nocase
        $alias_3 = "win32/autorunerent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUTORUNERENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Autorunerent tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autorunerent"
        date = "2026-10-16"
    strings:
        $attrib_str = "autorunerent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Autoruns (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/autoruns
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AUTORUNS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Autoruns (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autoruns"
        date = "2026-10-16"
    strings:
        $fam_name = "autoruns" ascii wide nocase
        $alias_1 = "hacktool:win32/autoruns" ascii wide nocase
        $alias_2 = "virtool:win32/autoruns" ascii wide nocase
        $alias_3 = "trojan:win32/autoruns" ascii wide nocase
        $alias_4 = "win32/autoruns" ascii wide nocase
        $alias_5 = "tool:win32/autoruns" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AUTORUNS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Autoruns tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/autoruns"
        date = "2026-10-16"
    strings:
        $attrib_str = "autoruns" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Avira (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/avira
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AVIRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Avira (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/avira"
        date = "2026-10-16"
    strings:
        $fam_name = "avira" ascii wide nocase
        $alias_1 = "fakeav.avira" ascii wide nocase
        $alias_2 = "masquerading.avira" ascii wide nocase
        $alias_3 = "rogue.avira" ascii wide nocase
        $alias_4 = "ransom:win32/avira" ascii wide nocase
        $alias_5 = "ransom.win32.avira" ascii wide nocase
        $alias_6 = "win32/avira" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AVIRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Avira tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/avira"
        date = "2026-10-16"
    strings:
        $attrib_str = "avira" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Avkiller (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/avkiller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AVKILLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Avkiller (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/avkiller"
        date = "2026-10-16"
    strings:
        $fam_name = "avkiller" ascii wide nocase
        $alias_1 = "ransom:win32/avkiller" ascii wide nocase
        $alias_2 = "ransom.win32.avkiller" ascii wide nocase
        $alias_3 = "win32/avkiller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AVKILLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Avkiller tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/avkiller"
        date = "2026-10-16"
    strings:
        $attrib_str = "avkiller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Awangba (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/awangba
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AWANGBA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Awangba (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/awangba"
        date = "2026-10-16"
    strings:
        $fam_name = "awangba" ascii wide nocase
        $alias_1 = "adware.awangba" ascii wide nocase
        $alias_2 = "pup.wangba" ascii wide nocase
        $alias_3 = "browserhijacker.awangba" ascii wide nocase
        $alias_4 = "ransom:win32/awangba" ascii wide nocase
        $alias_5 = "ransom.win32.awangba" ascii wide nocase
        $alias_6 = "win32/awangba" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AWANGBA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Awangba tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/awangba"
        date = "2026-10-16"
    strings:
        $attrib_str = "awangba" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Axbn (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/axbn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AXBN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Axbn (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/axbn"
        date = "2026-10-16"
    strings:
        $fam_name = "axbn" ascii wide nocase
        $alias_1 = "ransom:win32/axbn" ascii wide nocase
        $alias_2 = "ransom.win32.axbn" ascii wide nocase
        $alias_3 = "win32/axbn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AXBN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Axbn tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/axbn"
        date = "2026-10-16"
    strings:
        $attrib_str = "axbn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Axespec (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/axespec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AXESPEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Axespec (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/axespec"
        date = "2026-10-16"
    strings:
        $fam_name = "axespec" ascii wide nocase
        $alias_1 = "trojan:win32/axespec" ascii wide nocase
        $alias_2 = "trojan.win32.axespec" ascii wide nocase
        $alias_3 = "win32/axespec" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AXESPEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Axespec tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/axespec"
        date = "2026-10-16"
    strings:
        $attrib_str = "axespec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ayolog (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ayolog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AYOLOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ayolog (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ayolog"
        date = "2026-10-16"
    strings:
        $fam_name = "ayolog" ascii wide nocase
        $alias_1 = "trojan.keylogger.ayolog" ascii wide nocase
        $alias_2 = "spyware.ayolog" ascii wide nocase
        $alias_3 = "win32/ayolog" ascii wide nocase
        $alias_4 = "trojan:win32/ayolog" ascii wide nocase
        $alias_5 = "trojan.win32.ayolog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AYOLOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ayolog tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ayolog"
        date = "2026-10-16"
    strings:
        $attrib_str = "ayolog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Azden (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/azden
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AZDEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Azden (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/azden"
        date = "2026-10-16"
    strings:
        $fam_name = "azden" ascii wide nocase
        $alias_1 = "ransom:win32/azden" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.azden" ascii wide nocase
        $alias_3 = "win32/azden" ascii wide nocase
        $alias_4 = "ransom.azden" ascii wide nocase
        $alias_5 = "azden ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AZDEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Azden tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/azden"
        date = "2026-10-16"
    strings:
        $attrib_str = "azden" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Azero (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/azero
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AZERO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Azero (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/azero"
        date = "2026-10-16"
    strings:
        $fam_name = "azero" ascii wide nocase
        $alias_1 = "ransom:win32/azero" ascii wide nocase
        $alias_2 = "ransom.win32.azero" ascii wide nocase
        $alias_3 = "win32/azero" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AZERO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Azero tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/azero"
        date = "2026-10-16"
    strings:
        $attrib_str = "azero" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Azorult (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/azorult
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_AZORULT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Azorult (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/azorult"
        date = "2026-10-16"
    strings:
        $fam_name = "azorult" ascii wide nocase
        $alias_1 = "azorult" ascii wide nocase
        $alias_2 = "azorult" ascii wide nocase
        $alias_3 = "infostealer.azorult" ascii wide nocase
        $alias_4 = "trojan.azorult" ascii wide nocase
        $alias_5 = "win32/azorult" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_AZORULT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Azorult tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/azorult"
        date = "2026-10-16"
    strings:
        $attrib_str = "azorult" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Babar (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/babar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BABAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Babar (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/babar"
        date = "2026-10-16"
    strings:
        $fam_name = "babar" ascii wide nocase
        $alias_1 = "babar" ascii wide nocase
        $alias_2 = "trojan.babar" ascii wide nocase
        $alias_3 = "win32/babar" ascii wide nocase
        $alias_4 = "animal farm babar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BABAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Babar tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/babar"
        date = "2026-10-16"
    strings:
        $attrib_str = "babar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Babel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/babel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BABEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Babel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/babel"
        date = "2026-10-16"
    strings:
        $fam_name = "babel" ascii wide nocase
        $alias_1 = "trojan.babel" ascii wide nocase
        $alias_2 = "backdoor.babelrat" ascii wide nocase
        $alias_3 = "win32/babel" ascii wide nocase
        $alias_4 = "ransom:win32/babel" ascii wide nocase
        $alias_5 = "ransom.win32.babel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BABEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Babel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/babel"
        date = "2026-10-16"
    strings:
        $attrib_str = "babel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Babonock (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/babonock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BABONOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Babonock (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/babonock"
        date = "2026-10-16"
    strings:
        $fam_name = "babonock" ascii wide nocase
        $alias_1 = "trojan.babonock" ascii wide nocase
        $alias_2 = "downloader.babonock" ascii wide nocase
        $alias_3 = "win32/babonock" ascii wide nocase
        $alias_4 = "ransom:win32/babonock" ascii wide nocase
        $alias_5 = "ransom.win32.babonock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BABONOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Babonock tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/babonock"
        date = "2026-10-16"
    strings:
        $attrib_str = "babonock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Babylon (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/babylon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BABYLON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Babylon (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/babylon"
        date = "2026-10-16"
    strings:
        $fam_name = "babylon" ascii wide nocase
        $alias_1 = "browsermodifier:win32/babylon" ascii wide nocase
        $alias_2 = "adware:win32/babylon" ascii wide nocase
        $alias_3 = "pua:win32/babylontoolbar" ascii wide nocase
        $alias_4 = "babylon search" ascii wide nocase
        $alias_5 = "babylon toolbar" ascii wide nocase
        $alias_6 = "win32/babylon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BABYLON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Babylon tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/babylon"
        date = "2026-10-16"
    strings:
        $attrib_str = "babylon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Bacalid (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bacalid
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BACALID_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bacalid (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bacalid"
        date = "2026-10-16"
    strings:
        $fam_name = "bacalid" ascii wide nocase
        $alias_1 = "trojan.bacalid" ascii wide nocase
        $alias_2 = "downloader.bacalid" ascii wide nocase
        $alias_3 = "win32/bacalid" ascii wide nocase
        $alias_4 = "ransom:win32/bacalid" ascii wide nocase
        $alias_5 = "ransom.win32.bacalid" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BACALID_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bacalid tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bacalid"
        date = "2026-10-16"
    strings:
        $attrib_str = "bacalid" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Back_Orifice (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/back_orifice
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BACK_ORIFICE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Back_Orifice (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/back_orifice"
        date = "2026-10-16"
    strings:
        $fam_name = "back_orifice" ascii wide nocase
        $alias_1 = "bo" ascii wide nocase
        $alias_2 = "back orifice 2000" ascii wide nocase
        $alias_3 = "bo2k" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BACK_ORIFICE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Back_Orifice tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/back_orifice"
        date = "2026-10-16"
    strings:
        $attrib_str = "back_orifice" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Backboot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/backboot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BACKBOOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Backboot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/backboot"
        date = "2026-10-16"
    strings:
        $fam_name = "backboot" ascii wide nocase
        $alias_1 = "trojan:win32/backboot" ascii wide nocase
        $alias_2 = "trojan:win32/backboot.a" ascii wide nocase
        $alias_3 = "virtool:win32/backboot" ascii wide nocase
        $alias_4 = "backdoor:win32/backboot" ascii wide nocase
        $alias_5 = "win32/backboot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BACKBOOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Backboot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/backboot"
        date = "2026-10-16"
    strings:
        $attrib_str = "backboot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Backswap (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/backswap
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BACKSWAP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Backswap (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/backswap"
        date = "2026-10-16"
    strings:
        $fam_name = "backswap" ascii wide nocase
        $alias_1 = "trojan:win32/backswap" ascii wide nocase
        $alias_2 = "trojan.win32.backswap" ascii wide nocase
        $alias_3 = "win32/backswap" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BACKSWAP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Backswap tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/backswap"
        date = "2026-10-16"
    strings:
        $attrib_str = "backswap" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Badjoke (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/badjoke
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BADJOKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Badjoke (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/badjoke"
        date = "2026-10-16"
    strings:
        $fam_name = "badjoke" ascii wide nocase
        $alias_1 = "jokeprogram" ascii wide nocase
        $alias_2 = "hoax.badjoke" ascii wide nocase
        $alias_3 = "riskware.joke" ascii wide nocase
        $alias_4 = "ransom:win32/badjoke" ascii wide nocase
        $alias_5 = "ransom.win32.badjoke" ascii wide nocase
        $alias_6 = "win32/badjoke" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BADJOKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Badjoke tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/badjoke"
        date = "2026-10-16"
    strings:
        $attrib_str = "badjoke" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Badur (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/badur
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BADUR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Badur (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/badur"
        date = "2026-10-16"
    strings:
        $fam_name = "badur" ascii wide nocase
        $alias_1 = "trojan:win32/badur" ascii wide nocase
        $alias_2 = "trojandownloader:win32/badur.a" ascii wide nocase
        $alias_3 = "backdoor:win32/badur" ascii wide nocase
        $alias_4 = "win32/badur" ascii wide nocase
        $alias_5 = "trojan.badur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BADUR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Badur tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/badur"
        date = "2026-10-16"
    strings:
        $attrib_str = "badur" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bagif (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bagif
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BAGIF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bagif (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bagif"
        date = "2026-10-16"
    strings:
        $fam_name = "bagif" ascii wide nocase
        $alias_1 = "ransom:win32/bagif" ascii wide nocase
        $alias_2 = "ransom.win32.bagif" ascii wide nocase
        $alias_3 = "win32/bagif" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BAGIF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bagif tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bagif"
        date = "2026-10-16"
    strings:
        $attrib_str = "bagif" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bagle (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bagle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BAGLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bagle (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bagle"
        date = "2026-10-16"
    strings:
        $fam_name = "bagle" ascii wide nocase
        $alias_1 = "backdoor:win32/bagle" ascii wide nocase
        $alias_2 = "backdoor.win32.bagle" ascii wide nocase
        $alias_3 = "win32/bagle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BAGLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bagle tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bagle"
        date = "2026-10-16"
    strings:
        $attrib_str = "bagle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Bagsu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bagsu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BAGSU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bagsu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bagsu"
        date = "2026-10-16"
    strings:
        $fam_name = "bagsu" ascii wide nocase
        $alias_1 = "ransom:win32/bagsu" ascii wide nocase
        $alias_2 = "ransom.win32.bagsu" ascii wide nocase
        $alias_3 = "win32/bagsu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BAGSU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bagsu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bagsu"
        date = "2026-10-16"
    strings:
        $attrib_str = "bagsu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Baidu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/baidu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BAIDU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Baidu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/baidu"
        date = "2026-10-16"
    strings:
        $fam_name = "baidu" ascii wide nocase
        $alias_1 = "ransom:win32/baidu" ascii wide nocase
        $alias_2 = "ransom.win32.baidu" ascii wide nocase
        $alias_3 = "win32/baidu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BAIDU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Baidu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/baidu"
        date = "2026-10-16"
    strings:
        $attrib_str = "baidu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Baidusearch (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/baidusearch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BAIDUSEARCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Baidusearch (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/baidusearch"
        date = "2026-10-16"
    strings:
        $fam_name = "baidusearch" ascii wide nocase
        $alias_1 = "trojan:win32/baidusearch" ascii wide nocase
        $alias_2 = "trojan.win32.baidusearch" ascii wide nocase
        $alias_3 = "win32/baidusearch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BAIDUSEARCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Baidusearch tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/baidusearch"
        date = "2026-10-16"
    strings:
        $attrib_str = "baidusearch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Baiduwrapper (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/baiduwrapper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BAIDUWRAPPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Baiduwrapper (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/baiduwrapper"
        date = "2026-10-16"
    strings:
        $fam_name = "baiduwrapper" ascii wide nocase
        $alias_1 = "adware.baiduwrapper" ascii wide nocase
        $alias_2 = "pup.baidu" ascii wide nocase
        $alias_3 = "win32/adware.baidu" ascii wide nocase
        $alias_4 = "ransom:win32/baiduwrapper" ascii wide nocase
        $alias_5 = "ransom.win32.baiduwrapper" ascii wide nocase
        $alias_6 = "win32/baiduwrapper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BAIDUWRAPPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Baiduwrapper tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/baiduwrapper"
        date = "2026-10-16"
    strings:
        $attrib_str = "baiduwrapper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bamital (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bamital
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BAMITAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bamital (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bamital"
        date = "2026-10-16"
    strings:
        $fam_name = "bamital" ascii wide nocase
        $alias_1 = "trojan.bamital" ascii wide nocase
        $alias_2 = "w32/bamital" ascii wide nocase
        $alias_3 = "botnet.bamital" ascii wide nocase
        $alias_4 = "ransom:win32/bamital" ascii wide nocase
        $alias_5 = "ransom.win32.bamital" ascii wide nocase
        $alias_6 = "win32/bamital" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BAMITAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bamital tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bamital"
        date = "2026-10-16"
    strings:
        $attrib_str = "bamital" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bamsupr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bamsupr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BAMSUPR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bamsupr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bamsupr"
        date = "2026-10-16"
    strings:
        $fam_name = "bamsupr" ascii wide nocase
        $alias_1 = "trojan.bamsupr" ascii wide nocase
        $alias_2 = "downloader.bamsupr" ascii wide nocase
        $alias_3 = "win32/bamsupr" ascii wide nocase
        $alias_4 = "ransom:win32/bamsupr" ascii wide nocase
        $alias_5 = "ransom.win32.bamsupr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BAMSUPR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bamsupr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bamsupr"
        date = "2026-10-16"
    strings:
        $attrib_str = "bamsupr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Banbra (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/banbra
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANBRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Banbra (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banbra"
        date = "2026-10-16"
    strings:
        $fam_name = "banbra" ascii wide nocase
        $alias_1 = "trojan-banker.win32.banbra" ascii wide nocase
        $alias_2 = "trojan:win32/banbra" ascii wide nocase
        $alias_3 = "win32/banbra" ascii wide nocase
        $alias_4 = "banbra downloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANBRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Banbra tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banbra"
        date = "2026-10-16"
    strings:
        $attrib_str = "banbra" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bancobras (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bancobras
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANCOBRAS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bancobras (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bancobras"
        date = "2026-10-16"
    strings:
        $fam_name = "bancobras" ascii wide nocase
        $alias_1 = "trojan-banker.bancobras" ascii wide nocase
        $alias_2 = "banker.braz" ascii wide nocase
        $alias_3 = "win32/bancobras" ascii wide nocase
        $alias_4 = "trojan:win32/bancobras" ascii wide nocase
        $alias_5 = "trojan.win32.bancobras" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANCOBRAS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bancobras tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bancobras"
        date = "2026-10-16"
    strings:
        $attrib_str = "bancobras" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bancos (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bancos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANCOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bancos (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bancos"
        date = "2026-10-16"
    strings:
        $fam_name = "bancos" ascii wide nocase
        $alias_1 = "trojan-banker.win32.bancos" ascii wide nocase
        $alias_2 = "trojan:win32/bancos" ascii wide nocase
        $alias_3 = "win32/bancos" ascii wide nocase
        $alias_4 = "bancos banker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANCOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bancos tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bancos"
        date = "2026-10-16"
    strings:
        $attrib_str = "bancos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bancteian (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bancteian
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANCTEIAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bancteian (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bancteian"
        date = "2026-10-16"
    strings:
        $fam_name = "bancteian" ascii wide nocase
        $alias_1 = "trojan:win32/bancteian" ascii wide nocase
        $alias_2 = "trojandownloader:win32/bancteian" ascii wide nocase
        $alias_3 = "win32/bancteian" ascii wide nocase
        $alias_4 = "trojan.bancteian" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANCTEIAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bancteian tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bancteian"
        date = "2026-10-16"
    strings:
        $attrib_str = "bancteian" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Bandios (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bandios
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANDIOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bandios (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bandios"
        date = "2026-10-16"
    strings:
        $fam_name = "bandios" ascii wide nocase
        $alias_1 = "ransom:win32/bandios" ascii wide nocase
        $alias_2 = "ransom.win32.bandios" ascii wide nocase
        $alias_3 = "win32/bandios" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANDIOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bandios tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bandios"
        date = "2026-10-16"
    strings:
        $attrib_str = "bandios" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bandit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bandit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANDIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bandit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bandit"
        date = "2026-10-16"
    strings:
        $fam_name = "bandit" ascii wide nocase
        $alias_1 = "ransom:win32/bandit" ascii wide nocase
        $alias_2 = "ransom.win32.bandit" ascii wide nocase
        $alias_3 = "win32/bandit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANDIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bandit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bandit"
        date = "2026-10-16"
    strings:
        $attrib_str = "bandit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bandok (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bandok
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANDOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bandok (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bandok"
        date = "2026-10-16"
    strings:
        $fam_name = "bandok" ascii wide nocase
        $alias_1 = "trojan:win32/bandok" ascii wide nocase
        $alias_2 = "trojan.win32.bandok" ascii wide nocase
        $alias_3 = "win32/bandok" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANDOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bandok tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bandok"
        date = "2026-10-16"
    strings:
        $attrib_str = "bandok" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bandoo (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bandoo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANDOO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bandoo (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bandoo"
        date = "2026-10-16"
    strings:
        $fam_name = "bandoo" ascii wide nocase
        $alias_1 = "trojan:win32/bandoo" ascii wide nocase
        $alias_2 = "trojan.win32.bandoo" ascii wide nocase
        $alias_3 = "win32/bandoo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANDOO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bandoo tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bandoo"
        date = "2026-10-16"
    strings:
        $attrib_str = "bandoo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bandook (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bandook
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANDOOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bandook (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bandook"
        date = "2026-10-16"
    strings:
        $fam_name = "bandook" ascii wide nocase
        $alias_1 = "bandook" ascii wide nocase
        $alias_2 = "bandook rat" ascii wide nocase
        $alias_3 = "trojan.bandook" ascii wide nocase
        $alias_4 = "backdoor.bandook" ascii wide nocase
        $alias_5 = "win32/bandook" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANDOOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bandook tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bandook"
        date = "2026-10-16"
    strings:
        $attrib_str = "bandook" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Bang5Mai (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bang5mai
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANG5MAI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bang5Mai (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bang5mai"
        date = "2026-10-16"
    strings:
        $fam_name = "bang5mai" ascii wide nocase
        $alias_1 = "trojan:win32/bang5mai" ascii wide nocase
        $alias_2 = "backdoor:win32/bang5mai" ascii wide nocase
        $alias_3 = "trojan.bang5mai" ascii wide nocase
        $alias_4 = "win32/bang5mai" ascii wide nocase
        $alias_5 = "trojan:win32/bang5mai.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANG5MAI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bang5Mai tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bang5mai"
        date = "2026-10-16"
    strings:
        $attrib_str = "bang5mai" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Bank (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bank
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bank (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bank"
        date = "2026-10-16"
    strings:
        $fam_name = "bank" ascii wide nocase
        $alias_1 = "ransom:win32/bank" ascii wide nocase
        $alias_2 = "ransom.win32.bank" ascii wide nocase
        $alias_3 = "win32/bank" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bank tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bank"
        date = "2026-10-16"
    strings:
        $attrib_str = "bank" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bankfraud (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bankfraud
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANKFRAUD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bankfraud (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bankfraud"
        date = "2026-10-16"
    strings:
        $fam_name = "bankfraud" ascii wide nocase
        $alias_1 = "trojan.bankfraud" ascii wide nocase
        $alias_2 = "phish.bankfraud" ascii wide nocase
        $alias_3 = "fraud.win32" ascii wide nocase
        $alias_4 = "trojan:win32/bankfraud" ascii wide nocase
        $alias_5 = "trojan.win32.bankfraud" ascii wide nocase
        $alias_6 = "win32/bankfraud" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANKFRAUD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bankfraud tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bankfraud"
        date = "2026-10-16"
    strings:
        $attrib_str = "bankfraud" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bankoren (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bankoren
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANKOREN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bankoren (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bankoren"
        date = "2026-10-16"
    strings:
        $fam_name = "bankoren" ascii wide nocase
        $alias_1 = "trojan.bankoren" ascii wide nocase
        $alias_2 = "banker.bankoren" ascii wide nocase
        $alias_3 = "win32/bankoren" ascii wide nocase
        $alias_4 = "trojan:win32/bankoren" ascii wide nocase
        $alias_5 = "trojan.win32.bankoren" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANKOREN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bankoren tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bankoren"
        date = "2026-10-16"
    strings:
        $attrib_str = "bankoren" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Banks (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/banks
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANKS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Banks (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banks"
        date = "2026-10-16"
    strings:
        $fam_name = "banks" ascii wide nocase
        $alias_1 = "trojan:win32/banks" ascii wide nocase
        $alias_2 = "trojan.win32.banks" ascii wide nocase
        $alias_3 = "win32/banks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANKS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Banks tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banks"
        date = "2026-10-16"
    strings:
        $attrib_str = "banks" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Banload (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/banload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Banload (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banload"
        date = "2026-10-16"
    strings:
        $fam_name = "banload" ascii wide nocase
        $alias_1 = "trojandownloader:win32/banload" ascii wide nocase
        $alias_2 = "win32/banload" ascii wide nocase
        $alias_3 = "trojan-downloader.win32.banload" ascii wide nocase
        $alias_4 = "banload.a" ascii wide nocase
        $alias_5 = "banload.banker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Banload tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banload"
        date = "2026-10-16"
    strings:
        $attrib_str = "banload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Banpak (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/banpak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANPAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Banpak (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banpak"
        date = "2026-10-16"
    strings:
        $fam_name = "banpak" ascii wide nocase
        $alias_1 = "trojan:win32/banpak" ascii wide nocase
        $alias_2 = "trojan.win32.banpak" ascii wide nocase
        $alias_3 = "win32/banpak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANPAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Banpak tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banpak"
        date = "2026-10-16"
    strings:
        $attrib_str = "banpak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bansomqare (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bansomqare
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANSOMQARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bansomqare (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bansomqare"
        date = "2026-10-16"
    strings:
        $fam_name = "bansomqare" ascii wide nocase
        $alias_1 = "ransomware.generic" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.bansom" ascii wide nocase
        $alias_3 = "malware.cryptor" ascii wide nocase
        $alias_4 = "ransom:win32/bansomqare" ascii wide nocase
        $alias_5 = "ransom.win32.bansomqare" ascii wide nocase
        $alias_6 = "win32/bansomqare" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANSOMQARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bansomqare tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bansomqare"
        date = "2026-10-16"
    strings:
        $attrib_str = "bansomqare" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Banspy (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/banspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Banspy (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banspy"
        date = "2026-10-16"
    strings:
        $fam_name = "banspy" ascii wide nocase
        $alias_1 = "pws:win32/banspy" ascii wide nocase
        $alias_2 = "pws.win32.banspy" ascii wide nocase
        $alias_3 = "win32/banspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Banspy tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "banspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Banz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/banz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BANZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Banz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banz"
        date = "2026-10-16"
    strings:
        $fam_name = "banz" ascii wide nocase
        $alias_1 = "ransom:win32/banz" ascii wide nocase
        $alias_2 = "ransom.win32.banz" ascii wide nocase
        $alias_3 = "win32/banz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BANZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Banz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/banz"
        date = "2026-10-16"
    strings:
        $attrib_str = "banz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Barys (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/barys
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BARYS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Barys (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/barys"
        date = "2026-10-16"
    strings:
        $fam_name = "barys" ascii wide nocase
        $alias_1 = "trojan:win32/barys" ascii wide nocase
        $alias_2 = "trojan:powershell/barys" ascii wide nocase
        $alias_3 = "trojan.barys" ascii wide nocase
        $alias_4 = "win32/barys" ascii wide nocase
        $alias_5 = "trojan-spy.msil.barys" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BARYS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Barys tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/barys"
        date = "2026-10-16"
    strings:
        $attrib_str = "barys" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Baryumka (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/baryumka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BARYUMKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Baryumka (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/baryumka"
        date = "2026-10-16"
    strings:
        $fam_name = "baryumka" ascii wide nocase
        $alias_1 = "ransom:win32/baryumka" ascii wide nocase
        $alias_2 = "ransom.win32.baryumka" ascii wide nocase
        $alias_3 = "win32/baryumka" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BARYUMKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Baryumka tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/baryumka"
        date = "2026-10-16"
    strings:
        $attrib_str = "baryumka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Baserch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/baserch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BASERCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Baserch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/baserch"
        date = "2026-10-16"
    strings:
        $fam_name = "baserch" ascii wide nocase
        $alias_1 = "ransom:win32/baserch" ascii wide nocase
        $alias_2 = "ransom.win32.baserch" ascii wide nocase
        $alias_3 = "win32/baserch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BASERCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Baserch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/baserch"
        date = "2026-10-16"
    strings:
        $attrib_str = "baserch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Basine (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/basine
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BASINE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Basine (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/basine"
        date = "2026-10-16"
    strings:
        $fam_name = "basine" ascii wide nocase
        $alias_1 = "ransom:win32/basine" ascii wide nocase
        $alias_2 = "ransom.win32.basine" ascii wide nocase
        $alias_3 = "win32/basine" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BASINE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Basine tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/basine"
        date = "2026-10-16"
    strings:
        $attrib_str = "basine" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Batlauncher (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/batlauncher
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BATLAUNCHER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Batlauncher (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/batlauncher"
        date = "2026-10-16"
    strings:
        $fam_name = "batlauncher" ascii wide nocase
        $alias_1 = "ransom:win32/batlauncher" ascii wide nocase
        $alias_2 = "ransom.win32.batlauncher" ascii wide nocase
        $alias_3 = "win32/batlauncher" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BATLAUNCHER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Batlauncher tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/batlauncher"
        date = "2026-10-16"
    strings:
        $attrib_str = "batlauncher" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Batton (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/batton
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BATTON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Batton (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/batton"
        date = "2026-10-16"
    strings:
        $fam_name = "batton" ascii wide nocase
        $alias_1 = "trojan.batton" ascii wide nocase
        $alias_2 = "downloader.batton" ascii wide nocase
        $alias_3 = "win32/batton" ascii wide nocase
        $alias_4 = "ransom:win32/batton" ascii wide nocase
        $alias_5 = "ransom.win32.batton" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BATTON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Batton tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/batton"
        date = "2026-10-16"
    strings:
        $attrib_str = "batton" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bayrob (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bayrob
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BAYROB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bayrob (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bayrob"
        date = "2026-10-16"
    strings:
        $fam_name = "bayrob" ascii wide nocase
        $alias_1 = "trojan.bayrob" ascii wide nocase
        $alias_2 = "win32/bayrob" ascii wide nocase
        $alias_3 = "w32.bayrob" ascii wide nocase
        $alias_4 = "trojan:win32/bayrob" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BAYROB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bayrob tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bayrob"
        date = "2026-10-16"
    strings:
        $attrib_str = "bayrob" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bccrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bccrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BCCRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bccrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bccrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "bccrypt" ascii wide nocase
        $alias_1 = "ransom:win32/bccrypt" ascii wide nocase
        $alias_2 = "ransom.win32.bccrypt" ascii wide nocase
        $alias_3 = "win32/bccrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BCCRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bccrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bccrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "bccrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Be3Auestydmi (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/be3auestydmi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BE3AUESTYDMI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Be3Auestydmi (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/be3auestydmi"
        date = "2026-10-16"
    strings:
        $fam_name = "be3auestydmi" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.be3auestydmi" ascii wide nocase
        $alias_3 = "heur.be3auestydmi" ascii wide nocase
        $alias_4 = "trojan:win32/be3auestydmi" ascii wide nocase
        $alias_5 = "trojan.win32.be3auestydmi" ascii wide nocase
        $alias_6 = "win32/be3auestydmi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BE3AUESTYDMI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Be3Auestydmi tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/be3auestydmi"
        date = "2026-10-16"
    strings:
        $attrib_str = "be3auestydmi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Beast (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/beast
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BEAST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Beast (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/beast"
        date = "2026-10-16"
    strings:
        $fam_name = "beast" ascii wide nocase
        $alias_1 = "beast rat" ascii wide nocase
        $alias_2 = "tataye" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BEAST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Beast tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/beast"
        date = "2026-10-16"
    strings:
        $attrib_str = "beast" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Beastdoor (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/beastdoor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BEASTDOOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Beastdoor (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/beastdoor"
        date = "2026-10-16"
    strings:
        $fam_name = "beastdoor" ascii wide nocase
        $alias_1 = "backdoor.beast" ascii wide nocase
        $alias_2 = "trojan.beastdoor" ascii wide nocase
        $alias_3 = "bds/beast" ascii wide nocase
        $alias_4 = "backdoor:win32/beastdoor" ascii wide nocase
        $alias_5 = "backdoor.win32.beastdoor" ascii wide nocase
        $alias_6 = "win32/beastdoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BEASTDOOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Beastdoor tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/beastdoor"
        date = "2026-10-16"
    strings:
        $attrib_str = "beastdoor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Beaugrit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/beaugrit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BEAUGRIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Beaugrit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/beaugrit"
        date = "2026-10-16"
    strings:
        $fam_name = "beaugrit" ascii wide nocase
        $alias_1 = "ransom:win32/beaugrit" ascii wide nocase
        $alias_2 = "ransom.win32.beaugrit" ascii wide nocase
        $alias_3 = "win32/beaugrit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BEAUGRIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Beaugrit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/beaugrit"
        date = "2026-10-16"
    strings:
        $attrib_str = "beaugrit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bebloh (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bebloh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BEBLOH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bebloh (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bebloh"
        date = "2026-10-16"
    strings:
        $fam_name = "bebloh" ascii wide nocase
        $alias_1 = "trojan:win32/bebloh" ascii wide nocase
        $alias_2 = "trojan.win32.bebloh" ascii wide nocase
        $alias_3 = "win32/bebloh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BEBLOH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bebloh tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bebloh"
        date = "2026-10-16"
    strings:
        $attrib_str = "bebloh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bedefco (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bedefco
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BEDEFCO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bedefco (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bedefco"
        date = "2026-10-16"
    strings:
        $fam_name = "bedefco" ascii wide nocase
        $alias_1 = "trojan.bedefco" ascii wide nocase
        $alias_2 = "downloader.bedefco" ascii wide nocase
        $alias_3 = "win32/bedefco" ascii wide nocase
        $alias_4 = "ransom:win32/bedefco" ascii wide nocase
        $alias_5 = "ransom.win32.bedefco" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BEDEFCO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bedefco tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bedefco"
        date = "2026-10-16"
    strings:
        $attrib_str = "bedefco" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bedep (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bedep
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BEDEP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bedep (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bedep"
        date = "2026-10-16"
    strings:
        $fam_name = "bedep" ascii wide nocase
        $alias_1 = "ransom:win32/bedep" ascii wide nocase
        $alias_2 = "ransom.win32.bedep" ascii wide nocase
        $alias_3 = "win32/bedep" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BEDEP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bedep tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bedep"
        date = "2026-10-16"
    strings:
        $attrib_str = "bedep" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Beebone (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/beebone
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BEEBONE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Beebone (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/beebone"
        date = "2026-10-16"
    strings:
        $fam_name = "beebone" ascii wide nocase
        $alias_1 = "beebone" ascii wide nocase
        $alias_2 = "w32.worm.beebone" ascii wide nocase
        $alias_3 = "worm.beebone" ascii wide nocase
        $alias_4 = "aaeh" ascii wide nocase
        $alias_5 = "vbcrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BEEBONE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Beebone tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/beebone"
        date = "2026-10-16"
    strings:
        $attrib_str = "beebone" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Begseabug (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/begseabug
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BEGSEABUG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Begseabug (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/begseabug"
        date = "2026-10-16"
    strings:
        $fam_name = "begseabug" ascii wide nocase
        $alias_1 = "ransom:win32/begseabug" ascii wide nocase
        $alias_2 = "ransom.win32.begseabug" ascii wide nocase
        $alias_3 = "win32/begseabug" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BEGSEABUG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Begseabug tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/begseabug"
        date = "2026-10-16"
    strings:
        $attrib_str = "begseabug" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Behav (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/behav
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BEHAV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Behav (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/behav"
        date = "2026-10-16"
    strings:
        $fam_name = "behav" ascii wide nocase
        $alias_1 = "ransom:win32/behav" ascii wide nocase
        $alias_2 = "ransom.win32.behav" ascii wide nocase
        $alias_3 = "win32/behav" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BEHAV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Behav tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/behav"
        date = "2026-10-16"
    strings:
        $attrib_str = "behav" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Belonard (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/belonard
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BELONARD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Belonard (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/belonard"
        date = "2026-10-16"
    strings:
        $fam_name = "belonard" ascii wide nocase
        $alias_1 = "ransom:win32/belonard" ascii wide nocase
        $alias_2 = "ransom.win32.belonard" ascii wide nocase
        $alias_3 = "win32/belonard" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BELONARD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Belonard tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/belonard"
        date = "2026-10-16"
    strings:
        $attrib_str = "belonard" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Benban (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/benban
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BENBAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Benban (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/benban"
        date = "2026-10-16"
    strings:
        $fam_name = "benban" ascii wide nocase
        $alias_1 = "trojan.benban" ascii wide nocase
        $alias_2 = "downloader.benban" ascii wide nocase
        $alias_3 = "win32/benban" ascii wide nocase
        $alias_4 = "ransom:win32/benban" ascii wide nocase
        $alias_5 = "ransom.win32.benban" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BENBAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Benban tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/benban"
        date = "2026-10-16"
    strings:
        $attrib_str = "benban" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Benjamin (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/benjamin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BENJAMIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Benjamin (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/benjamin"
        date = "2026-10-16"
    strings:
        $fam_name = "benjamin" ascii wide nocase
        $alias_1 = "worm:win32/benjamin.a" ascii wide nocase
        $alias_2 = "w32.benjamin.worm" ascii wide nocase
        $alias_3 = "p2p-worm.win32.benjamin" ascii wide nocase
        $alias_4 = "i-worm.benjamin" ascii wide nocase
        $alias_5 = "w32/benjamin.worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BENJAMIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Benjamin tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/benjamin"
        date = "2026-10-16"
    strings:
        $attrib_str = "benjamin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Berbew (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/berbew
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BERBEW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Berbew (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/berbew"
        date = "2026-10-16"
    strings:
        $fam_name = "berbew" ascii wide nocase
        $alias_1 = "berbew" ascii wide nocase
        $alias_2 = "padodor" ascii wide nocase
        $alias_3 = "trojan:win32/berbew" ascii wide nocase
        $alias_4 = "win32/berbew" ascii wide nocase
        $alias_5 = "trojan.berbew" ascii wide nocase
        $alias_6 = "backdoor.padodor" ascii wide nocase
        $alias_7 = "trojan.padodor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BERBEW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Berbew tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/berbew"
        date = "2026-10-16"
    strings:
        $attrib_str = "berbew" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bero (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bero
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BERO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bero (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bero"
        date = "2026-10-16"
    strings:
        $fam_name = "bero" ascii wide nocase
        $alias_1 = "ransom:win32/bero" ascii wide nocase
        $alias_2 = "ransom.win32.bero" ascii wide nocase
        $alias_3 = "win32/bero" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BERO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bero tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bero"
        date = "2026-10-16"
    strings:
        $attrib_str = "bero" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bersek (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bersek
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BERSEK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bersek (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bersek"
        date = "2026-10-16"
    strings:
        $fam_name = "bersek" ascii wide nocase
        $alias_1 = "bersek backdoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BERSEK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bersek tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bersek"
        date = "2026-10-16"
    strings:
        $attrib_str = "bersek" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Bertle (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bertle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BERTLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bertle (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bertle"
        date = "2026-10-16"
    strings:
        $fam_name = "bertle" ascii wide nocase
        $alias_1 = "trojan.bertle" ascii wide nocase
        $alias_2 = "downloader.bertle" ascii wide nocase
        $alias_3 = "win32/bertle" ascii wide nocase
        $alias_4 = "ransom:win32/bertle" ascii wide nocase
        $alias_5 = "ransom.win32.bertle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BERTLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bertle tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bertle"
        date = "2026-10-16"
    strings:
        $attrib_str = "bertle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bestafera (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bestafera
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BESTAFERA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bestafera (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bestafera"
        date = "2026-10-16"
    strings:
        $fam_name = "bestafera" ascii wide nocase
        $alias_1 = "trojan-banker:win32/bestafera" ascii wide nocase
        $alias_2 = "trojan.win32.bestafera" ascii wide nocase
        $alias_3 = "win32/bestafera" ascii wide nocase
        $alias_4 = "bestafera banker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BESTAFERA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bestafera tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bestafera"
        date = "2026-10-16"
    strings:
        $attrib_str = "bestafera" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Betabot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/betabot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BETABOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Betabot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/betabot"
        date = "2026-10-16"
    strings:
        $fam_name = "betabot" ascii wide nocase
        $alias_1 = "trojan:win32/betabot" ascii wide nocase
        $alias_2 = "trojan.win32.betabot" ascii wide nocase
        $alias_3 = "win32/betabot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BETABOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Betabot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/betabot"
        date = "2026-10-16"
    strings:
        $attrib_str = "betabot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Betkrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/betkrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BETKRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Betkrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/betkrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "betkrypt" ascii wide nocase
        $alias_1 = "ransom:win32/betkrypt" ascii wide nocase
        $alias_2 = "ransom.win32.betkrypt" ascii wide nocase
        $alias_3 = "win32/betkrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BETKRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Betkrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/betkrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "betkrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Betload (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/betload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BETLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Betload (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/betload"
        date = "2026-10-16"
    strings:
        $fam_name = "betload" ascii wide nocase
        $alias_1 = "ransom:win32/betload" ascii wide nocase
        $alias_2 = "trojan:win32/betload" ascii wide nocase
        $alias_3 = "trojandownloader:win32/betload" ascii wide nocase
        $alias_4 = "win32/betload" ascii wide nocase
        $alias_5 = "betload ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BETLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Betload tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/betload"
        date = "2026-10-16"
    strings:
        $attrib_str = "betload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bettersurf (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bettersurf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BETTERSURF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bettersurf (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bettersurf"
        date = "2026-10-16"
    strings:
        $fam_name = "bettersurf" ascii wide nocase
        $alias_1 = "adware.bettersurf" ascii wide nocase
        $alias_2 = "pup.bettersurf" ascii wide nocase
        $alias_3 = "win32/adware.bettersurf" ascii wide nocase
        $alias_4 = "adware:win32/bettersurf" ascii wide nocase
        $alias_5 = "adware.win32.bettersurf" ascii wide nocase
        $alias_6 = "win32/bettersurf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BETTERSURF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bettersurf tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bettersurf"
        date = "2026-10-16"
    strings:
        $attrib_str = "bettersurf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Beyondkeylogger (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/beyondkeylogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BEYONDKEYLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Beyondkeylogger (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/beyondkeylogger"
        date = "2026-10-16"
    strings:
        $fam_name = "beyondkeylogger" ascii wide nocase
        $alias_1 = "pws:win32/beyondkeylogger" ascii wide nocase
        $alias_2 = "pws.win32.beyondkeylogger" ascii wide nocase
        $alias_3 = "win32/beyondkeylogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BEYONDKEYLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Beyondkeylogger tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/beyondkeylogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "beyondkeylogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bhoint (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bhoint
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BHOINT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bhoint (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bhoint"
        date = "2026-10-16"
    strings:
        $fam_name = "bhoint" ascii wide nocase
        $alias_1 = "adware.bhoint" ascii wide nocase
        $alias_2 = "pup.bhoint" ascii wide nocase
        $alias_3 = "win32/adware.bho" ascii wide nocase
        $alias_4 = "trojan:win32/bhoint" ascii wide nocase
        $alias_5 = "trojan.win32.bhoint" ascii wide nocase
        $alias_6 = "win32/bhoint" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BHOINT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bhoint tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bhoint"
        date = "2026-10-16"
    strings:
        $attrib_str = "bhoint" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bhosta (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bhosta
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BHOSTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bhosta (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bhosta"
        date = "2026-10-16"
    strings:
        $fam_name = "bhosta" ascii wide nocase
        $alias_1 = "trojan.bhosta" ascii wide nocase
        $alias_2 = "downloader.bhosta" ascii wide nocase
        $alias_3 = "win32/bhosta" ascii wide nocase
        $alias_4 = "ransom:win32/bhosta" ascii wide nocase
        $alias_5 = "ransom.win32.bhosta" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BHOSTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bhosta tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bhosta"
        date = "2026-10-16"
    strings:
        $attrib_str = "bhosta" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bhxu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bhxu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BHXU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bhxu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bhxu"
        date = "2026-10-16"
    strings:
        $fam_name = "bhxu" ascii wide nocase
        $alias_1 = "trojan.bhxu" ascii wide nocase
        $alias_2 = "downloader.bhxu" ascii wide nocase
        $alias_3 = "win32/bhxu" ascii wide nocase
        $alias_4 = "ransom:win32/bhxu" ascii wide nocase
        $alias_5 = "ransom.win32.bhxu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BHXU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bhxu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bhxu"
        date = "2026-10-16"
    strings:
        $attrib_str = "bhxu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bicololo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bicololo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BICOLOLO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bicololo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bicololo"
        date = "2026-10-16"
    strings:
        $fam_name = "bicololo" ascii wide nocase
        $alias_1 = "ransom:win32/bicololo" ascii wide nocase
        $alias_2 = "ransom.win32.bicololo" ascii wide nocase
        $alias_3 = "win32/bicololo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BICOLOLO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bicololo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bicololo"
        date = "2026-10-16"
    strings:
        $attrib_str = "bicololo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bifrose (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bifrose
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BIFROSE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bifrose (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bifrose"
        date = "2026-10-16"
    strings:
        $fam_name = "bifrose" ascii wide nocase
        $alias_1 = "backdoor:win32/bifrose" ascii wide nocase
        $alias_2 = "backdoor.bifrost" ascii wide nocase
        $alias_3 = "bifrost rat" ascii wide nocase
        $alias_4 = "constructor:win32/bifrose.a" ascii wide nocase
        $alias_5 = "bifrose" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BIFROSE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bifrose tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bifrose"
        date = "2026-10-16"
    strings:
        $attrib_str = "bifrose" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Bifrost (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bifrost
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BIFROST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bifrost (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bifrost"
        date = "2026-10-16"
    strings:
        $fam_name = "bifrost" ascii wide nocase
        $alias_1 = "bifrose" ascii wide nocase
        $alias_2 = "backdoor:win32/bifrose" ascii wide nocase
        $alias_3 = "trojan.bifrose" ascii wide nocase
        $alias_4 = "win32/bifrose" ascii wide nocase
        $alias_5 = "bifrost rat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BIFROST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bifrost tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bifrost"
        date = "2026-10-16"
    strings:
        $attrib_str = "bifrost" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Binder (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/binder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BINDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Binder (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/binder"
        date = "2026-10-16"
    strings:
        $fam_name = "binder" ascii wide nocase
        $alias_1 = "hacktool:win32/binder" ascii wide nocase
        $alias_2 = "trojan:win32/binder" ascii wide nocase
        $alias_3 = "win32/binder" ascii wide nocase
        $alias_4 = "filebinder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BINDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Binder tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/binder"
        date = "2026-10-16"
    strings:
        $attrib_str = "binder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Binderon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/binderon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BINDERON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Binderon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/binderon"
        date = "2026-10-16"
    strings:
        $fam_name = "binderon" ascii wide nocase
        $alias_1 = "trojan.binderon" ascii wide nocase
        $alias_2 = "downloader.binderon" ascii wide nocase
        $alias_3 = "win32/binderon" ascii wide nocase
        $alias_4 = "ransom:win32/binderon" ascii wide nocase
        $alias_5 = "ransom.win32.binderon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BINDERON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Binderon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/binderon"
        date = "2026-10-16"
    strings:
        $attrib_str = "binderon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bindex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bindex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BINDEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bindex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bindex"
        date = "2026-10-16"
    strings:
        $fam_name = "bindex" ascii wide nocase
        $alias_1 = "trojan.bindex" ascii wide nocase
        $alias_2 = "downloader.bindex" ascii wide nocase
        $alias_3 = "win32/bindex" ascii wide nocase
        $alias_4 = "ransom:win32/bindex" ascii wide nocase
        $alias_5 = "ransom.win32.bindex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BINDEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bindex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bindex"
        date = "2026-10-16"
    strings:
        $attrib_str = "bindex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bindjpg (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bindjpg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BINDJPG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bindjpg (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bindjpg"
        date = "2026-10-16"
    strings:
        $fam_name = "bindjpg" ascii wide nocase
        $alias_1 = "trojan.bindjpg" ascii wide nocase
        $alias_2 = "exploit.win32.bindjpg" ascii wide nocase
        $alias_3 = "trojan-dropper.win32.bind" ascii wide nocase
        $alias_4 = "trojan:win32/bindjpg" ascii wide nocase
        $alias_5 = "trojan.win32.bindjpg" ascii wide nocase
        $alias_6 = "win32/bindjpg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BINDJPG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bindjpg tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bindjpg"
        date = "2026-10-16"
    strings:
        $attrib_str = "bindjpg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Birele (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/birele
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BIRELE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Birele (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/birele"
        date = "2026-10-16"
    strings:
        $fam_name = "birele" ascii wide nocase
        $alias_1 = "ransom:win32/birele" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.birele" ascii wide nocase
        $alias_3 = "win32/birele" ascii wide nocase
        $alias_4 = "birele ransomware" ascii wide nocase
        $alias_5 = "ransom.birele" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BIRELE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Birele tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/birele"
        date = "2026-10-16"
    strings:
        $attrib_str = "birele" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bisonal (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bisonal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BISONAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bisonal (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bisonal"
        date = "2026-10-16"
    strings:
        $fam_name = "bisonal" ascii wide nocase
        $alias_1 = "trojan:win32/bisonal" ascii wide nocase
        $alias_2 = "trojan.win32.bisonal" ascii wide nocase
        $alias_3 = "win32/bisonal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BISONAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bisonal tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bisonal"
        date = "2026-10-16"
    strings:
        $attrib_str = "bisonal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bitcovar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bitcovar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BITCOVAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bitcovar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitcovar"
        date = "2026-10-16"
    strings:
        $fam_name = "bitcovar" ascii wide nocase
        $alias_1 = "ransom:win32/bitcovar" ascii wide nocase
        $alias_2 = "ransom.win32.bitcovar" ascii wide nocase
        $alias_3 = "win32/bitcovar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BITCOVAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bitcovar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitcovar"
        date = "2026-10-16"
    strings:
        $attrib_str = "bitcovar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bitman (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bitman
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BITMAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bitman (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitman"
        date = "2026-10-16"
    strings:
        $fam_name = "bitman" ascii wide nocase
        $alias_1 = "ransom:win32/bitman" ascii wide nocase
        $alias_2 = "ransom.win32.bitman" ascii wide nocase
        $alias_3 = "win32/bitman" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BITMAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bitman tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitman"
        date = "2026-10-16"
    strings:
        $attrib_str = "bitman" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bitmin (Coinminer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bitmin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BITMIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bitmin (Coinminer)"
        category = "Coinminer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitmin"
        date = "2026-10-16"
    strings:
        $fam_name = "bitmin" ascii wide nocase
        $alias_1 = "trojan:win32/bitmin" ascii wide nocase
        $alias_2 = "trojan:win32/bitman" ascii wide nocase
        $alias_3 = "trojan.win32.bitman" ascii wide nocase
        $alias_4 = "coinminer.win32.bitman" ascii wide nocase
        $alias_5 = "riskware.bitmin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BITMIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bitmin tradecraft"
        category = "Coinminer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitmin"
        date = "2026-10-16"
    strings:
        $attrib_str = "bitmin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Bitrep (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bitrep
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BITREP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bitrep (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitrep"
        date = "2026-10-16"
    strings:
        $fam_name = "bitrep" ascii wide nocase
        $alias_1 = "trojan:win32/bitrep" ascii wide nocase
        $alias_2 = "trojan:win32/bitrep.a" ascii wide nocase
        $alias_3 = "trojandownloader:win32/bitrep" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BITREP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bitrep tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitrep"
        date = "2026-10-16"
    strings:
        $attrib_str = "bitrep" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bitrepeyp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bitrepeyp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BITREPEYP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bitrepeyp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitrepeyp"
        date = "2026-10-16"
    strings:
        $fam_name = "bitrepeyp" ascii wide nocase
        $alias_1 = "trojan.bitrepeyp" ascii wide nocase
        $alias_2 = "downloader.bitrepeyp" ascii wide nocase
        $alias_3 = "win32/bitrepeyp" ascii wide nocase
        $alias_4 = "ransom:win32/bitrepeyp" ascii wide nocase
        $alias_5 = "ransom.win32.bitrepeyp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BITREPEYP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bitrepeyp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitrepeyp"
        date = "2026-10-16"
    strings:
        $attrib_str = "bitrepeyp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bits (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bits
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BITS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bits (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bits"
        date = "2026-10-16"
    strings:
        $fam_name = "bits" ascii wide nocase
        $alias_1 = "ransom:win32/bits" ascii wide nocase
        $alias_2 = "ransom.win32.bits" ascii wide nocase
        $alias_3 = "win32/bits" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BITS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bits tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bits"
        date = "2026-10-16"
    strings:
        $attrib_str = "bits" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bitter (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bitter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BITTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bitter (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitter"
        date = "2026-10-16"
    strings:
        $fam_name = "bitter" ascii wide nocase
        $alias_1 = "trojan:win32/bitter" ascii wide nocase
        $alias_2 = "trojan.win32.bitter" ascii wide nocase
        $alias_3 = "win32/bitter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BITTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bitter tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitter"
        date = "2026-10-16"
    strings:
        $attrib_str = "bitter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bitwallet (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bitwallet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BITWALLET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bitwallet (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitwallet"
        date = "2026-10-16"
    strings:
        $fam_name = "bitwallet" ascii wide nocase
        $alias_1 = "trojan.coinstealer" ascii wide nocase
        $alias_2 = "pws.bitwallet" ascii wide nocase
        $alias_3 = "trojanspy.cryptosteal" ascii wide nocase
        $alias_4 = "trojan:win32/bitwallet" ascii wide nocase
        $alias_5 = "trojan.win32.bitwallet" ascii wide nocase
        $alias_6 = "win32/bitwallet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BITWALLET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bitwallet tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bitwallet"
        date = "2026-10-16"
    strings:
        $attrib_str = "bitwallet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bkff (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bkff
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BKFF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bkff (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bkff"
        date = "2026-10-16"
    strings:
        $fam_name = "bkff" ascii wide nocase
        $alias_1 = "trojan.bkff" ascii wide nocase
        $alias_2 = "downloader.bkff" ascii wide nocase
        $alias_3 = "win32/bkff" ascii wide nocase
        $alias_4 = "ransom:win32/bkff" ascii wide nocase
        $alias_5 = "ransom.win32.bkff" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BKFF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bkff tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bkff"
        date = "2026-10-16"
    strings:
        $attrib_str = "bkff" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Black (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/black
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Black (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/black"
        date = "2026-10-16"
    strings:
        $fam_name = "black" ascii wide nocase
        $alias_1 = "ransom:win32/black" ascii wide nocase
        $alias_2 = "ransomware.blackmatter" ascii wide nocase
        $alias_3 = "trojan-ransom.win32.black" ascii wide nocase
        $alias_4 = "win32/black.ransomware" ascii wide nocase
        $alias_5 = "blackmatter.ransom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Black tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/black"
        date = "2026-10-16"
    strings:
        $attrib_str = "black" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Blacked (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blacked
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLACKED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blacked (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blacked"
        date = "2026-10-16"
    strings:
        $fam_name = "blacked" ascii wide nocase
        $alias_1 = "ransom:win32/blacked" ascii wide nocase
        $alias_2 = "ransom.win32.blacked" ascii wide nocase
        $alias_3 = "win32/blacked" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLACKED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blacked tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blacked"
        date = "2026-10-16"
    strings:
        $attrib_str = "blacked" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Blackenergy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blackenergy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLACKENERGY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blackenergy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blackenergy"
        date = "2026-10-16"
    strings:
        $fam_name = "blackenergy" ascii wide nocase
        $alias_1 = "blackenergy" ascii wide nocase
        $alias_2 = "blackenergy 2" ascii wide nocase
        $alias_3 = "blackenergy 3" ascii wide nocase
        $alias_4 = "sandworm toolkit" ascii wide nocase
        $alias_5 = "win32/blackenergy" ascii wide nocase
        $alias_6 = "backdoor.blackenergy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLACKENERGY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blackenergy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blackenergy"
        date = "2026-10-16"
    strings:
        $attrib_str = "blackenergy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Blackhole (Exploit_Kit)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blackhole
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLACKHOLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blackhole (Exploit_Kit)"
        category = "Exploit_Kit"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blackhole"
        date = "2026-10-16"
    strings:
        $fam_name = "blackhole" ascii wide nocase
        $alias_1 = "exploit:win32/blackhole" ascii wide nocase
        $alias_2 = "blackhole exploit kit" ascii wide nocase
        $alias_3 = "bhek" ascii wide nocase
        $alias_4 = "trojandownloader:win32/blackhole" ascii wide nocase
        $alias_5 = "exploit.blackhole" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLACKHOLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blackhole tradecraft"
        category = "Exploit_Kit"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blackhole"
        date = "2026-10-16"
    strings:
        $attrib_str = "blackhole" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Blackmoon (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blackmoon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLACKMOON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blackmoon (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blackmoon"
        date = "2026-10-16"
    strings:
        $fam_name = "blackmoon" ascii wide nocase
        $alias_1 = "blackmoon" ascii wide nocase
        $alias_2 = "krbanker" ascii wide nocase
        $alias_3 = "trojan.blackmoon" ascii wide nocase
        $alias_4 = "win32/blackmoon" ascii wide nocase
        $alias_5 = "banker.krbanker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLACKMOON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blackmoon tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blackmoon"
        date = "2026-10-16"
    strings:
        $attrib_str = "blackmoon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Blackstealer (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blackstealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLACKSTEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blackstealer (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blackstealer"
        date = "2026-10-16"
    strings:
        $fam_name = "blackstealer" ascii wide nocase
        $alias_1 = "trojan.blackstealer" ascii wide nocase
        $alias_2 = "infostealer.black" ascii wide nocase
        $alias_3 = "win32/spy.stealer" ascii wide nocase
        $alias_4 = "pws:win32/blackstealer" ascii wide nocase
        $alias_5 = "pws.win32.blackstealer" ascii wide nocase
        $alias_6 = "win32/blackstealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLACKSTEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blackstealer tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blackstealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "blackstealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Blackv (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blackv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLACKV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blackv (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blackv"
        date = "2026-10-16"
    strings:
        $fam_name = "blackv" ascii wide nocase
        $alias_1 = "ransom:win32/blackv" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.blackv" ascii wide nocase
        $alias_3 = "win32/blackv" ascii wide nocase
        $alias_4 = "blackv ransomware" ascii wide nocase
        $alias_5 = "ransom.blackv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLACKV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blackv tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blackv"
        date = "2026-10-16"
    strings:
        $attrib_str = "blackv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Blacoleref (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blacoleref
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLACOLEREF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blacoleref (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blacoleref"
        date = "2026-10-16"
    strings:
        $fam_name = "blacoleref" ascii wide nocase
        $alias_1 = "ransom:win32/blacoleref" ascii wide nocase
        $alias_2 = "ransom.win32.blacoleref" ascii wide nocase
        $alias_3 = "win32/blacoleref" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLACOLEREF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blacoleref tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blacoleref"
        date = "2026-10-16"
    strings:
        $attrib_str = "blacoleref" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bladabindi (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bladabindi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLADABINDI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bladabindi (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bladabindi"
        date = "2026-10-16"
    strings:
        $fam_name = "bladabindi" ascii wide nocase
        $alias_1 = "njrat" ascii wide nocase
        $alias_2 = "bladabindi" ascii wide nocase
        $alias_3 = "njw0rm" ascii wide nocase
        $alias_4 = "jenxcus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLADABINDI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bladabindi tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bladabindi"
        date = "2026-10-16"
    strings:
        $attrib_str = "bladabindi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Blakamba (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blakamba
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLAKAMBA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blakamba (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blakamba"
        date = "2026-10-16"
    strings:
        $fam_name = "blakamba" ascii wide nocase
        $alias_1 = "ransom:win32/blakamba" ascii wide nocase
        $alias_2 = "ransom.win32.blakamba" ascii wide nocase
        $alias_3 = "win32/blakamba" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLAKAMBA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blakamba tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blakamba"
        date = "2026-10-16"
    strings:
        $attrib_str = "blakamba" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Blamon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blamon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLAMON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blamon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blamon"
        date = "2026-10-16"
    strings:
        $fam_name = "blamon" ascii wide nocase
        $alias_1 = "ransom:win32/blamon" ascii wide nocase
        $alias_2 = "ransom:win32/blamon.a" ascii wide nocase
        $alias_3 = "trojan-ransom.win32.blamon" ascii wide nocase
        $alias_4 = "win32/blamon" ascii wide nocase
        $alias_5 = "ransom.blamon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLAMON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blamon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blamon"
        date = "2026-10-16"
    strings:
        $attrib_str = "blamon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Blasterx (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blasterx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLASTERX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blasterx (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blasterx"
        date = "2026-10-16"
    strings:
        $fam_name = "blasterx" ascii wide nocase
        $alias_1 = "w32.blaster.x" ascii wide nocase
        $alias_2 = "lovsan variant" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLASTERX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blasterx tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blasterx"
        date = "2026-10-16"
    strings:
        $attrib_str = "blasterx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Blihan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blihan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLIHAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blihan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blihan"
        date = "2026-10-16"
    strings:
        $fam_name = "blihan" ascii wide nocase
        $alias_1 = "ransom:win32/blihan" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.blihan" ascii wide nocase
        $alias_3 = "win32/blihan" ascii wide nocase
        $alias_4 = "ransom.blihan" ascii wide nocase
        $alias_5 = "ransom:win32/blihan.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLIHAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blihan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blihan"
        date = "2026-10-16"
    strings:
        $attrib_str = "blihan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Blind (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blind
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLIND_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blind (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blind"
        date = "2026-10-16"
    strings:
        $fam_name = "blind" ascii wide nocase
        $alias_1 = "ransom:win32/blind" ascii wide nocase
        $alias_2 = "ransom.win32.blind" ascii wide nocase
        $alias_3 = "win32/blind" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLIND_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blind tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blind"
        date = "2026-10-16"
    strings:
        $attrib_str = "blind" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Blokrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blokrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLOKRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blokrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blokrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "blokrypt" ascii wide nocase
        $alias_1 = "ransom.blokrypt" ascii wide nocase
        $alias_2 = "win32/filecoder.blokrypt" ascii wide nocase
        $alias_3 = "trojan-ransom.win32.blokrypt" ascii wide nocase
        $alias_4 = "ransom:win32/blokrypt" ascii wide nocase
        $alias_5 = "ransom.win32.blokrypt" ascii wide nocase
        $alias_6 = "win32/blokrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLOKRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blokrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blokrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "blokrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bloored (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bloored
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLOORED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bloored (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bloored"
        date = "2026-10-16"
    strings:
        $fam_name = "bloored" ascii wide nocase
        $alias_1 = "trojan:win32/bloored" ascii wide nocase
        $alias_2 = "trojan.bloored" ascii wide nocase
        $alias_3 = "trojan.win32.bloored" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLOORED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bloored tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bloored"
        date = "2026-10-16"
    strings:
        $attrib_str = "bloored" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Blouiroet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blouiroet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLOUIROET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blouiroet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blouiroet"
        date = "2026-10-16"
    strings:
        $fam_name = "blouiroet" ascii wide nocase
        $alias_1 = "ransom:win32/blouiroet" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.blouiroet" ascii wide nocase
        $alias_3 = "trojan.blouiroet" ascii wide nocase
        $alias_4 = "win32/blouiroet" ascii wide nocase
        $alias_5 = "ransom:win32/blouiroet.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLOUIROET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blouiroet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blouiroet"
        date = "2026-10-16"
    strings:
        $attrib_str = "blouiroet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Blubot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blubot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLUBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blubot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blubot"
        date = "2026-10-16"
    strings:
        $fam_name = "blubot" ascii wide nocase
        $alias_1 = "ransom:win32/blubot" ascii wide nocase
        $alias_2 = "ransom.win32.blubot" ascii wide nocase
        $alias_3 = "win32/blubot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLUBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blubot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blubot"
        date = "2026-10-16"
    strings:
        $attrib_str = "blubot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Blueeagle (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blueeagle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLUEEAGLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blueeagle (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blueeagle"
        date = "2026-10-16"
    strings:
        $fam_name = "blueeagle" ascii wide nocase
        $alias_1 = "ransom:win32/blueeagle" ascii wide nocase
        $alias_2 = "ransom.win32.blueeagle" ascii wide nocase
        $alias_3 = "win32/blueeagle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLUEEAGLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blueeagle tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blueeagle"
        date = "2026-10-16"
    strings:
        $attrib_str = "blueeagle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Blueh (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blueh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLUEH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blueh (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blueh"
        date = "2026-10-16"
    strings:
        $fam_name = "blueh" ascii wide nocase
        $alias_1 = "ransom:win32/blueh" ascii wide nocase
        $alias_2 = "ransom.win32.blueh" ascii wide nocase
        $alias_3 = "win32/blueh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLUEH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blueh tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blueh"
        date = "2026-10-16"
    strings:
        $attrib_str = "blueh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bluewushu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bluewushu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLUEWUSHU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bluewushu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bluewushu"
        date = "2026-10-16"
    strings:
        $fam_name = "bluewushu" ascii wide nocase
        $alias_1 = "ransom:win32/bluewushu" ascii wide nocase
        $alias_2 = "ransom.win32.bluewushu" ascii wide nocase
        $alias_3 = "win32/bluewushu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLUEWUSHU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bluewushu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bluewushu"
        date = "2026-10-16"
    strings:
        $attrib_str = "bluewushu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bluteal (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bluteal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLUTEAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bluteal (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bluteal"
        date = "2026-10-16"
    strings:
        $fam_name = "bluteal" ascii wide nocase
        $alias_1 = "ransom:win32/bluteal" ascii wide nocase
        $alias_2 = "ransom.win32.bluteal" ascii wide nocase
        $alias_3 = "win32/bluteal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLUTEAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bluteal tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bluteal"
        date = "2026-10-16"
    strings:
        $attrib_str = "bluteal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bmgfrznl2Gfaa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bmgfrznl2gfaa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BMGFRZNL2GFAA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bmgfrznl2Gfaa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bmgfrznl2gfaa"
        date = "2026-10-16"
    strings:
        $fam_name = "bmgfrznl2gfaa" ascii wide nocase
        $alias_1 = "trojan.generic.bmgfrznl2gfaa" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
        $alias_4 = "ransom:win32/bmgfrznl2gfaa" ascii wide nocase
        $alias_5 = "ransom.win32.bmgfrznl2gfaa" ascii wide nocase
        $alias_6 = "win32/bmgfrznl2gfaa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BMGFRZNL2GFAA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bmgfrznl2Gfaa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bmgfrznl2gfaa"
        date = "2026-10-16"
    strings:
        $attrib_str = "bmgfrznl2gfaa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bmkfxasqf6Ki (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bmkfxasqf6ki
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BMKFXASQF6KI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bmkfxasqf6Ki (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bmkfxasqf6ki"
        date = "2026-10-16"
    strings:
        $fam_name = "bmkfxasqf6ki" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.bmkfxasqf6ki" ascii wide nocase
        $alias_3 = "heur.bmkfxasqf6ki" ascii wide nocase
        $alias_4 = "trojan:win32/bmkfxasqf6ki" ascii wide nocase
        $alias_5 = "trojan.win32.bmkfxasqf6ki" ascii wide nocase
        $alias_6 = "win32/bmkfxasqf6ki" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BMKFXASQF6KI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bmkfxasqf6Ki tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bmkfxasqf6ki"
        date = "2026-10-16"
    strings:
        $attrib_str = "bmkfxasqf6ki" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bmmedia (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bmmedia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BMMEDIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bmmedia (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bmmedia"
        date = "2026-10-16"
    strings:
        $fam_name = "bmmedia" ascii wide nocase
        $alias_1 = "adware.bmmedia" ascii wide nocase
        $alias_2 = "pup.bmmedia" ascii wide nocase
        $alias_3 = "browsermodifier.bmmedia" ascii wide nocase
        $alias_4 = "ransom:win32/bmmedia" ascii wide nocase
        $alias_5 = "ransom.win32.bmmedia" ascii wide nocase
        $alias_6 = "win32/bmmedia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BMMEDIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bmmedia tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bmmedia"
        date = "2026-10-16"
    strings:
        $attrib_str = "bmmedia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bmsdus4Ufhei (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bmsdus4ufhei
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BMSDUS4UFHEI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bmsdus4Ufhei (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bmsdus4ufhei"
        date = "2026-10-16"
    strings:
        $fam_name = "bmsdus4ufhei" ascii wide nocase
        $alias_1 = "trojan.generic.bmsdus4ufhei" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
        $alias_4 = "ransom:win32/bmsdus4ufhei" ascii wide nocase
        $alias_5 = "ransom.win32.bmsdus4ufhei" ascii wide nocase
        $alias_6 = "win32/bmsdus4ufhei" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BMSDUS4UFHEI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bmsdus4Ufhei tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bmsdus4ufhei"
        date = "2026-10-16"
    strings:
        $attrib_str = "bmsdus4ufhei" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bnksa (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bnksa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BNKSA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bnksa (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bnksa"
        date = "2026-10-16"
    strings:
        $fam_name = "bnksa" ascii wide nocase
        $alias_1 = "trojan.bnksa" ascii wide nocase
        $alias_2 = "trojan-banker.win32.bnksa" ascii wide nocase
        $alias_3 = "banker.bnksa" ascii wide nocase
        $alias_4 = "trojan:win32/bnksa" ascii wide nocase
        $alias_5 = "trojan.win32.bnksa" ascii wide nocase
        $alias_6 = "win32/bnksa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BNKSA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bnksa tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bnksa"
        date = "2026-10-16"
    strings:
        $attrib_str = "bnksa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bnqp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bnqp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BNQP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bnqp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bnqp"
        date = "2026-10-16"
    strings:
        $fam_name = "bnqp" ascii wide nocase
        $alias_1 = "trojan.bnqp" ascii wide nocase
        $alias_2 = "downloader.bnqp" ascii wide nocase
        $alias_3 = "win32/bnqp" ascii wide nocase
        $alias_4 = "ransom:win32/bnqp" ascii wide nocase
        $alias_5 = "ransom.win32.bnqp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BNQP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bnqp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bnqp"
        date = "2026-10-16"
    strings:
        $attrib_str = "bnqp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bnuaaewgb2Fb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bnuaaewgb2fb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BNUAAEWGB2FB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bnuaaewgb2Fb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bnuaaewgb2fb"
        date = "2026-10-16"
    strings:
        $fam_name = "bnuaaewgb2fb" ascii wide nocase
        $alias_1 = "trojan.bnuaaewgb2fb" ascii wide nocase
        $alias_2 = "win32/trojan.obfuscated" ascii wide nocase
        $alias_3 = "suspicious.dga" ascii wide nocase
        $alias_4 = "ransom:win32/bnuaaewgb2fb" ascii wide nocase
        $alias_5 = "ransom.win32.bnuaaewgb2fb" ascii wide nocase
        $alias_6 = "win32/bnuaaewgb2fb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BNUAAEWGB2FB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bnuaaewgb2Fb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bnuaaewgb2fb"
        date = "2026-10-16"
    strings:
        $attrib_str = "bnuaaewgb2fb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Boaxxe (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/boaxxe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOAXXE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Boaxxe (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boaxxe"
        date = "2026-10-16"
    strings:
        $fam_name = "boaxxe" ascii wide nocase
        $alias_1 = "ransom:win32/boaxxe" ascii wide nocase
        $alias_2 = "ransom.win32.boaxxe" ascii wide nocase
        $alias_3 = "win32/boaxxe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOAXXE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Boaxxe tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boaxxe"
        date = "2026-10-16"
    strings:
        $attrib_str = "boaxxe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bobax (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bobax
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOBAX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bobax (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bobax"
        date = "2026-10-16"
    strings:
        $fam_name = "bobax" ascii wide nocase
        $alias_1 = "trojan:win32/bobax" ascii wide nocase
        $alias_2 = "trojan.win32.bobax" ascii wide nocase
        $alias_3 = "win32/bobax" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOBAX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bobax tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bobax"
        date = "2026-10-16"
    strings:
        $attrib_str = "bobax" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bodegun (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bodegun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BODEGUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bodegun (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bodegun"
        date = "2026-10-16"
    strings:
        $fam_name = "bodegun" ascii wide nocase
        $alias_1 = "ransom:win32/bodegun" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.bodegun" ascii wide nocase
        $alias_3 = "win32/bodegun" ascii wide nocase
        $alias_4 = "ransom.bodegun" ascii wide nocase
        $alias_5 = "bodegun ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BODEGUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bodegun tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bodegun"
        date = "2026-10-16"
    strings:
        $attrib_str = "bodegun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Boht (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/boht
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOHT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Boht (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boht"
        date = "2026-10-16"
    strings:
        $fam_name = "boht" ascii wide nocase
        $alias_1 = "ransom:win32/boht" ascii wide nocase
        $alias_2 = "ransom.win32.boht" ascii wide nocase
        $alias_3 = "win32/boht" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOHT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Boht tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boht"
        date = "2026-10-16"
    strings:
        $attrib_str = "boht" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Boilod (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/boilod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOILOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Boilod (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boilod"
        date = "2026-10-16"
    strings:
        $fam_name = "boilod" ascii wide nocase
        $alias_1 = "adware:win32/boilod" ascii wide nocase
        $alias_2 = "backdoor:msil/boilod!pz" ascii wide nocase
        $alias_3 = "adware.win32.boilod" ascii wide nocase
        $alias_4 = "pua:win32/boilod" ascii wide nocase
        $alias_5 = "win32/boilod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOILOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Boilod tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boilod"
        date = "2026-10-16"
    strings:
        $attrib_str = "boilod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Bolik (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bolik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOLIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bolik (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bolik"
        date = "2026-10-16"
    strings:
        $fam_name = "bolik" ascii wide nocase
        $alias_1 = "trojan-banker.win32.bolik" ascii wide nocase
        $alias_2 = "carberp.variant" ascii wide nocase
        $alias_3 = "win32/bolik" ascii wide nocase
        $alias_4 = "trojan:win32/bolik" ascii wide nocase
        $alias_5 = "trojan.win32.bolik" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOLIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bolik tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bolik"
        date = "2026-10-16"
    strings:
        $attrib_str = "bolik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bomka (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bomka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOMKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bomka (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bomka"
        date = "2026-10-16"
    strings:
        $fam_name = "bomka" ascii wide nocase
        $alias_1 = "adware.bomka" ascii wide nocase
        $alias_2 = "pup.bomka" ascii wide nocase
        $alias_3 = "browsermodifier:win32/bomka" ascii wide nocase
        $alias_4 = "ransom:win32/bomka" ascii wide nocase
        $alias_5 = "ransom.win32.bomka" ascii wide nocase
        $alias_6 = "win32/bomka" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOMKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bomka tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bomka"
        date = "2026-10-16"
    strings:
        $attrib_str = "bomka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bonkyhp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bonkyhp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BONKYHP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bonkyhp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bonkyhp"
        date = "2026-10-16"
    strings:
        $fam_name = "bonkyhp" ascii wide nocase
        $alias_1 = "ransom:win32/bonkyhp" ascii wide nocase
        $alias_2 = "ransom.win32.bonkyhp" ascii wide nocase
        $alias_3 = "win32/bonkyhp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BONKYHP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bonkyhp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bonkyhp"
        date = "2026-10-16"
    strings:
        $attrib_str = "bonkyhp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Boopcel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/boopcel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOOPCEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Boopcel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boopcel"
        date = "2026-10-16"
    strings:
        $fam_name = "boopcel" ascii wide nocase
        $alias_1 = "ransom:win32/boopcel" ascii wide nocase
        $alias_2 = "ransom.win32.boopcel" ascii wide nocase
        $alias_3 = "win32/boopcel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOOPCEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Boopcel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boopcel"
        date = "2026-10-16"
    strings:
        $attrib_str = "boopcel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bototer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bototer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOTOTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bototer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bototer"
        date = "2026-10-16"
    strings:
        $fam_name = "bototer" ascii wide nocase
        $alias_1 = "trojan.bototer" ascii wide nocase
        $alias_2 = "botnet.bototer" ascii wide nocase
        $alias_3 = "win32/bototer" ascii wide nocase
        $alias_4 = "trojan:win32/bototer" ascii wide nocase
        $alias_5 = "trojan.win32.bototer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOTOTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bototer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bototer"
        date = "2026-10-16"
    strings:
        $attrib_str = "bototer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Boxter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/boxter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOXTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Boxter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boxter"
        date = "2026-10-16"
    strings:
        $fam_name = "boxter" ascii wide nocase
        $alias_1 = "adware.boxter" ascii wide nocase
        $alias_2 = "pup.boxter" ascii wide nocase
        $alias_3 = "win32/adware.boxter" ascii wide nocase
        $alias_4 = "ransom:win32/boxter" ascii wide nocase
        $alias_5 = "ransom.win32.boxter" ascii wide nocase
        $alias_6 = "win32/boxter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOXTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Boxter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boxter"
        date = "2026-10-16"
    strings:
        $attrib_str = "boxter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Boychi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/boychi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOYCHI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Boychi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boychi"
        date = "2026-10-16"
    strings:
        $fam_name = "boychi" ascii wide nocase
        $alias_1 = "adware.boychi" ascii wide nocase
        $alias_2 = "pup.boychi" ascii wide nocase
        $alias_3 = "browserhijacker.boychi" ascii wide nocase
        $alias_4 = "ransom:win32/boychi" ascii wide nocase
        $alias_5 = "ransom.win32.boychi" ascii wide nocase
        $alias_6 = "win32/boychi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOYCHI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Boychi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/boychi"
        date = "2026-10-16"
    strings:
        $attrib_str = "boychi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bozok (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bozok
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BOZOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bozok (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bozok"
        date = "2026-10-16"
    strings:
        $fam_name = "bozok" ascii wide nocase
        $alias_1 = "bozok rat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BOZOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bozok tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bozok"
        date = "2026-10-16"
    strings:
        $attrib_str = "bozok" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bplug (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bplug
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BPLUG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bplug (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bplug"
        date = "2026-10-16"
    strings:
        $fam_name = "bplug" ascii wide nocase
        $alias_1 = "adware.bplug" ascii wide nocase
        $alias_2 = "pup.bplug" ascii wide nocase
        $alias_3 = "win32/adware.plugin" ascii wide nocase
        $alias_4 = "ransom:win32/bplug" ascii wide nocase
        $alias_5 = "ransom.win32.bplug" ascii wide nocase
        $alias_6 = "win32/bplug" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BPLUG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bplug tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bplug"
        date = "2026-10-16"
    strings:
        $attrib_str = "bplug" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Brambul (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/brambul
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BRAMBUL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Brambul (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brambul"
        date = "2026-10-16"
    strings:
        $fam_name = "brambul" ascii wide nocase
        $alias_1 = "brambul" ascii wide nocase
        $alias_2 = "worm:win32/brambul" ascii wide nocase
        $alias_3 = "hidden cobra brambul" ascii wide nocase
        $alias_4 = "w32/brambul" ascii wide nocase
        $alias_5 = "trojan.brambul" ascii wide nocase
        $alias_6 = "lazarus smb worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BRAMBUL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Brambul tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brambul"
        date = "2026-10-16"
    strings:
        $attrib_str = "brambul" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Bredavi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bredavi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BREDAVI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bredavi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bredavi"
        date = "2026-10-16"
    strings:
        $fam_name = "bredavi" ascii wide nocase
        $alias_1 = "ransom:win32/bredavi" ascii wide nocase
        $alias_2 = "ransom.win32.bredavi" ascii wide nocase
        $alias_3 = "win32/bredavi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BREDAVI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bredavi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bredavi"
        date = "2026-10-16"
    strings:
        $attrib_str = "bredavi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bredo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bredo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BREDO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bredo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bredo"
        date = "2026-10-16"
    strings:
        $fam_name = "bredo" ascii wide nocase
        $alias_1 = "trojan-downloader.win32.bredo" ascii wide nocase
        $alias_2 = "bredolab" ascii wide nocase
        $alias_3 = "w32/bredo" ascii wide nocase
        $alias_4 = "ransom:win32/bredo" ascii wide nocase
        $alias_5 = "ransom.win32.bredo" ascii wide nocase
        $alias_6 = "win32/bredo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BREDO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bredo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bredo"
        date = "2026-10-16"
    strings:
        $attrib_str = "bredo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bredolab (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bredolab
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BREDOLAB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bredolab (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bredolab"
        date = "2026-10-16"
    strings:
        $fam_name = "bredolab" ascii wide nocase
        $alias_1 = "trojan-downloader.win32.bredolab" ascii wide nocase
        $alias_2 = "bredo" ascii wide nocase
        $alias_3 = "w32/bredolab" ascii wide nocase
        $alias_4 = "trojan:win32/bredolab" ascii wide nocase
        $alias_5 = "trojan.win32.bredolab" ascii wide nocase
        $alias_6 = "win32/bredolab" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BREDOLAB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bredolab tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bredolab"
        date = "2026-10-16"
    strings:
        $attrib_str = "bredolab" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bridex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bridex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BRIDEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bridex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bridex"
        date = "2026-10-16"
    strings:
        $fam_name = "bridex" ascii wide nocase
        $alias_1 = "trojan.bridex" ascii wide nocase
        $alias_2 = "downloader.bridex" ascii wide nocase
        $alias_3 = "win32/bridex" ascii wide nocase
        $alias_4 = "ransom:win32/bridex" ascii wide nocase
        $alias_5 = "ransom.win32.bridex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BRIDEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bridex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bridex"
        date = "2026-10-16"
    strings:
        $attrib_str = "bridex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Brobaneup (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/brobaneup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BROBANEUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Brobaneup (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brobaneup"
        date = "2026-10-16"
    strings:
        $fam_name = "brobaneup" ascii wide nocase
        $alias_1 = "ransom:win32/brobaneup" ascii wide nocase
        $alias_2 = "ransom.win32.brobaneup" ascii wide nocase
        $alias_3 = "win32/brobaneup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BROBANEUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Brobaneup tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brobaneup"
        date = "2026-10-16"
    strings:
        $attrib_str = "brobaneup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Broduplo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/broduplo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BRODUPLO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Broduplo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/broduplo"
        date = "2026-10-16"
    strings:
        $fam_name = "broduplo" ascii wide nocase
        $alias_1 = "ransom:win32/broduplo" ascii wide nocase
        $alias_2 = "ransom.win32.broduplo" ascii wide nocase
        $alias_3 = "win32/broduplo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BRODUPLO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Broduplo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/broduplo"
        date = "2026-10-16"
    strings:
        $attrib_str = "broduplo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Brontok (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/brontok
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BRONTOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Brontok (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brontok"
        date = "2026-10-16"
    strings:
        $fam_name = "brontok" ascii wide nocase
        $alias_1 = "worm:win32/brontok" ascii wide nocase
        $alias_2 = "worm:win32/brontok@mm" ascii wide nocase
        $alias_3 = "w32.rontokbro@mm" ascii wide nocase
        $alias_4 = "email-worm.win32.brontok" ascii wide nocase
        $alias_5 = "rontokbr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BRONTOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Brontok tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brontok"
        date = "2026-10-16"
    strings:
        $attrib_str = "brontok" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Brosafe (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/brosafe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BROSAFE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Brosafe (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brosafe"
        date = "2026-10-16"
    strings:
        $fam_name = "brosafe" ascii wide nocase
        $alias_1 = "pup.brosafe" ascii wide nocase
        $alias_2 = "adware.brosafe" ascii wide nocase
        $alias_3 = "brosafe adware" ascii wide nocase
        $alias_4 = "trojan:win32/brosafe" ascii wide nocase
        $alias_5 = "trojan.win32.brosafe" ascii wide nocase
        $alias_6 = "win32/brosafe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BROSAFE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Brosafe tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brosafe"
        date = "2026-10-16"
    strings:
        $attrib_str = "brosafe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Broskod (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/broskod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BROSKOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Broskod (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/broskod"
        date = "2026-10-16"
    strings:
        $fam_name = "broskod" ascii wide nocase
        $alias_1 = "trojan.broskod" ascii wide nocase
        $alias_2 = "downloader.broskod" ascii wide nocase
        $alias_3 = "win32/broskod" ascii wide nocase
        $alias_4 = "ransom:win32/broskod" ascii wide nocase
        $alias_5 = "ransom.win32.broskod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BROSKOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Broskod tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/broskod"
        date = "2026-10-16"
    strings:
        $attrib_str = "broskod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Browseban (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/browseban
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BROWSEBAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Browseban (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browseban"
        date = "2026-10-16"
    strings:
        $fam_name = "browseban" ascii wide nocase
        $alias_1 = "trojan:win32/browseban" ascii wide nocase
        $alias_2 = "trojan.win32.browseban" ascii wide nocase
        $alias_3 = "win32/browseban" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BROWSEBAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Browseban tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browseban"
        date = "2026-10-16"
    strings:
        $attrib_str = "browseban" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Browsecx (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/browsecx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BROWSECX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Browsecx (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browsecx"
        date = "2026-10-16"
    strings:
        $fam_name = "browsecx" ascii wide nocase
        $alias_1 = "adware.browsecx" ascii wide nocase
        $alias_2 = "pup.browsecx" ascii wide nocase
        $alias_3 = "browsermodifier:win32/browsecx" ascii wide nocase
        $alias_4 = "trojan:win32/browsecx" ascii wide nocase
        $alias_5 = "trojan.win32.browsecx" ascii wide nocase
        $alias_6 = "win32/browsecx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BROWSECX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Browsecx tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browsecx"
        date = "2026-10-16"
    strings:
        $attrib_str = "browsecx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Browsefox (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/browsefox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BROWSEFOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Browsefox (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browsefox"
        date = "2026-10-16"
    strings:
        $fam_name = "browsefox" ascii wide nocase
        $alias_1 = "adware:win32/browsefox" ascii wide nocase
        $alias_2 = "pua:win32/browsefox" ascii wide nocase
        $alias_3 = "pup.optional.browsefox" ascii wide nocase
        $alias_4 = "browsefox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BROWSEFOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Browsefox tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browsefox"
        date = "2026-10-16"
    strings:
        $attrib_str = "browsefox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Browserio (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/browserio
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BROWSERIO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Browserio (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browserio"
        date = "2026-10-16"
    strings:
        $fam_name = "browserio" ascii wide nocase
        $alias_1 = "pua:win32/browserio" ascii wide nocase
        $alias_2 = "adware.browserio" ascii wide nocase
        $alias_3 = "win32/browserio" ascii wide nocase
        $alias_4 = "browserio hijacker" ascii wide nocase
        $alias_5 = "browserio.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BROWSERIO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Browserio tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browserio"
        date = "2026-10-16"
    strings:
        $attrib_str = "browserio" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Browserpassview (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/browserpassview
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BROWSERPASSVIEW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Browserpassview (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browserpassview"
        date = "2026-10-16"
    strings:
        $fam_name = "browserpassview" ascii wide nocase
        $alias_1 = "pws:win32/browserpassview" ascii wide nocase
        $alias_2 = "pws.win32.browserpassview" ascii wide nocase
        $alias_3 = "win32/browserpassview" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BROWSERPASSVIEW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Browserpassview tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browserpassview"
        date = "2026-10-16"
    strings:
        $attrib_str = "browserpassview" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Browserpwdstealer (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/browserpwdstealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BROWSERPWDSTEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Browserpwdstealer (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browserpwdstealer"
        date = "2026-10-16"
    strings:
        $fam_name = "browserpwdstealer" ascii wide nocase
        $alias_1 = "pws:win32/browserpwdstealer" ascii wide nocase
        $alias_2 = "pws.win32.browserpwdstealer" ascii wide nocase
        $alias_3 = "win32/browserpwdstealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BROWSERPWDSTEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Browserpwdstealer tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browserpwdstealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "browserpwdstealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Browshot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/browshot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BROWSHOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Browshot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browshot"
        date = "2026-10-16"
    strings:
        $fam_name = "browshot" ascii wide nocase
        $alias_1 = "trojan:win32/browshot" ascii wide nocase
        $alias_2 = "trojan.win32.browshot" ascii wide nocase
        $alias_3 = "win32/browshot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BROWSHOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Browshot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/browshot"
        date = "2026-10-16"
    strings:
        $attrib_str = "browshot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Brresmon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/brresmon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BRRESMON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Brresmon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brresmon"
        date = "2026-10-16"
    strings:
        $fam_name = "brresmon" ascii wide nocase
        $alias_1 = "ransom:win32/brresmon" ascii wide nocase
        $alias_2 = "ransom.win32.brresmon" ascii wide nocase
        $alias_3 = "win32/brresmon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BRRESMON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Brresmon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brresmon"
        date = "2026-10-16"
    strings:
        $attrib_str = "brresmon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bruhorn (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bruhorn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BRUHORN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bruhorn (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bruhorn"
        date = "2026-10-16"
    strings:
        $fam_name = "bruhorn" ascii wide nocase
        $alias_1 = "ransom:win32/bruhorn" ascii wide nocase
        $alias_2 = "ransom.win32.bruhorn" ascii wide nocase
        $alias_3 = "win32/bruhorn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BRUHORN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bruhorn tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bruhorn"
        date = "2026-10-16"
    strings:
        $attrib_str = "bruhorn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bruteforce (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bruteforce
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BRUTEFORCE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bruteforce (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bruteforce"
        date = "2026-10-16"
    strings:
        $fam_name = "bruteforce" ascii wide nocase
        $alias_1 = "hacktool:win32/bruteforce" ascii wide nocase
        $alias_2 = "tool:win32/bruteforce" ascii wide nocase
        $alias_3 = "win32/bruteforce" ascii wide nocase
        $alias_4 = "rdp bruteforce tool" ascii wide nocase
        $alias_5 = "bruteforce password cracker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BRUTEFORCE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bruteforce tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bruteforce"
        date = "2026-10-16"
    strings:
        $attrib_str = "bruteforce" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Brutus (Tool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/brutus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BRUTUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Brutus (Tool)"
        category = "Tool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brutus"
        date = "2026-10-16"
    strings:
        $fam_name = "brutus" ascii wide nocase
        $alias_1 = "brutus password cracker" ascii wide nocase
        $alias_2 = "brutus aet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BRUTUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Brutus tradecraft"
        category = "Tool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/brutus"
        date = "2026-10-16"
    strings:
        $attrib_str = "brutus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Bsdownloader (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bsdownloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BSDOWNLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bsdownloader (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bsdownloader"
        date = "2026-10-16"
    strings:
        $fam_name = "bsdownloader" ascii wide nocase
        $alias_1 = "trojandownloader:win32/bsdownloader" ascii wide nocase
        $alias_2 = "trojandownloader.win32.bsdownloader" ascii wide nocase
        $alias_3 = "win32/bsdownloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BSDOWNLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bsdownloader tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bsdownloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "bsdownloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bsvsebni (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bsvsebni
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BSVSEBNI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bsvsebni (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bsvsebni"
        date = "2026-10-16"
    strings:
        $fam_name = "bsvsebni" ascii wide nocase
        $alias_1 = "trojan.bsvsebni" ascii wide nocase
        $alias_2 = "generic.bsvsebni" ascii wide nocase
        $alias_3 = "suspicious.bsvsebni" ascii wide nocase
        $alias_4 = "trojan:win32/bsvsebni" ascii wide nocase
        $alias_5 = "trojan.win32.bsvsebni" ascii wide nocase
        $alias_6 = "win32/bsvsebni" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BSVSEBNI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bsvsebni tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bsvsebni"
        date = "2026-10-16"
    strings:
        $attrib_str = "bsvsebni" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bsymem (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bsymem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BSYMEM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bsymem (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bsymem"
        date = "2026-10-16"
    strings:
        $fam_name = "bsymem" ascii wide nocase
        $alias_1 = "bsymem" ascii wide nocase
        $alias_2 = "trojan:win32/bsymem" ascii wide nocase
        $alias_3 = "trojan.bsymem" ascii wide nocase
        $alias_4 = "win32/bsymem" ascii wide nocase
        $alias_5 = "ransom.bsymem" ascii wide nocase
        $alias_6 = "trojan:win32/bsymem.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BSYMEM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bsymem tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bsymem"
        date = "2026-10-16"
    strings:
        $attrib_str = "bsymem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Btcon (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/btcon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BTCON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Btcon (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/btcon"
        date = "2026-10-16"
    strings:
        $fam_name = "btcon" ascii wide nocase
        $alias_1 = "trojan.btcon" ascii wide nocase
        $alias_2 = "coinminer.btcon" ascii wide nocase
        $alias_3 = "trojan.cointhief.btcon" ascii wide nocase
        $alias_4 = "trojan:win32/btcon" ascii wide nocase
        $alias_5 = "trojan.win32.btcon" ascii wide nocase
        $alias_6 = "win32/btcon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BTCON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Btcon tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/btcon"
        date = "2026-10-16"
    strings:
        $attrib_str = "btcon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Btcware (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/btcware
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BTCWARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Btcware (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/btcware"
        date = "2026-10-16"
    strings:
        $fam_name = "btcware" ascii wide nocase
        $alias_1 = "ransom:win32/btcware" ascii wide nocase
        $alias_2 = "ransom.win32.btcware" ascii wide nocase
        $alias_3 = "win32/btcware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BTCWARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Btcware tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/btcware"
        date = "2026-10-16"
    strings:
        $attrib_str = "btcware" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bubbledock (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bubbledock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUBBLEDOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bubbledock (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bubbledock"
        date = "2026-10-16"
    strings:
        $fam_name = "bubbledock" ascii wide nocase
        $alias_1 = "adware.bubbledock" ascii wide nocase
        $alias_2 = "pup.bubbledock" ascii wide nocase
        $alias_3 = "browsermodifier:win32/bubbledock" ascii wide nocase
        $alias_4 = "trojan:win32/bubbledock" ascii wide nocase
        $alias_5 = "trojan.win32.bubbledock" ascii wide nocase
        $alias_6 = "win32/bubbledock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUBBLEDOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bubbledock tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bubbledock"
        date = "2026-10-16"
    strings:
        $attrib_str = "bubbledock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bublik (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bublik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUBLIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bublik (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bublik"
        date = "2026-10-16"
    strings:
        $fam_name = "bublik" ascii wide nocase
        $alias_1 = "trojan-downloader.win32.bublik" ascii wide nocase
        $alias_2 = "trojan:win32/bublik" ascii wide nocase
        $alias_3 = "trojan.bublik" ascii wide nocase
        $alias_4 = "win32/bublik" ascii wide nocase
        $alias_5 = "downloader.bublik" ascii wide nocase
        $alias_6 = "trojan-downloader:win32/bublik.gen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUBLIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bublik tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bublik"
        date = "2026-10-16"
    strings:
        $attrib_str = "bublik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Buhtrap (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/buhtrap
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUHTRAP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Buhtrap (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/buhtrap"
        date = "2026-10-16"
    strings:
        $fam_name = "buhtrap" ascii wide nocase
        $alias_1 = "apt.buhtrap" ascii wide nocase
        $alias_2 = "trojan.buhtrap" ascii wide nocase
        $alias_3 = "win32/buhtrap" ascii wide nocase
        $alias_4 = "ransom:win32/buhtrap" ascii wide nocase
        $alias_5 = "ransom.win32.buhtrap" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUHTRAP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Buhtrap tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/buhtrap"
        date = "2026-10-16"
    strings:
        $attrib_str = "buhtrap" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bulta (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bulta
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BULTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bulta (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bulta"
        date = "2026-10-16"
    strings:
        $fam_name = "bulta" ascii wide nocase
        $alias_1 = "ransom:win32/bulta" ascii wide nocase
        $alias_2 = "ransom.win32.bulta" ascii wide nocase
        $alias_3 = "win32/bulta" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BULTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bulta tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bulta"
        date = "2026-10-16"
    strings:
        $attrib_str = "bulta" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bumat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bumat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUMAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bumat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bumat"
        date = "2026-10-16"
    strings:
        $fam_name = "bumat" ascii wide nocase
        $alias_1 = "trojan.bumat" ascii wide nocase
        $alias_2 = "downloader.bumat" ascii wide nocase
        $alias_3 = "win32/bumat" ascii wide nocase
        $alias_4 = "ransom:win32/bumat" ascii wide nocase
        $alias_5 = "ransom.win32.bumat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUMAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bumat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bumat"
        date = "2026-10-16"
    strings:
        $attrib_str = "bumat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bump_Rat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bump_rat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUMP_RAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bump_Rat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bump_rat"
        date = "2026-10-16"
    strings:
        $fam_name = "bump_rat" ascii wide nocase
        $alias_1 = "bumprat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUMP_RAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bump_Rat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bump_rat"
        date = "2026-10-16"
    strings:
        $attrib_str = "bump_rat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bundleloader (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bundleloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUNDLELOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bundleloader (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bundleloader"
        date = "2026-10-16"
    strings:
        $fam_name = "bundleloader" ascii wide nocase
        $alias_1 = "trojandownloader:win32/bundleloader" ascii wide nocase
        $alias_2 = "trojandownloader.win32.bundleloader" ascii wide nocase
        $alias_3 = "win32/bundleloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUNDLELOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bundleloader tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bundleloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "bundleloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bundlore (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bundlore
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUNDLORE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bundlore (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bundlore"
        date = "2026-10-16"
    strings:
        $fam_name = "bundlore" ascii wide nocase
        $alias_1 = "adware:osx/bundlore" ascii wide nocase
        $alias_2 = "adware:win32/bundlore" ascii wide nocase
        $alias_3 = "osx/bundlore" ascii wide nocase
        $alias_4 = "win32/bundlore" ascii wide nocase
        $alias_5 = "bundlore installer" ascii wide nocase
        $alias_6 = "osx.bundlore" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUNDLORE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bundlore tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bundlore"
        date = "2026-10-16"
    strings:
        $attrib_str = "bundlore" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Bunitu (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bunitu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUNITU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bunitu (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bunitu"
        date = "2026-10-16"
    strings:
        $fam_name = "bunitu" ascii wide nocase
        $alias_1 = "trojan:win32/bunitu" ascii wide nocase
        $alias_2 = "trojan.win32.bunitu" ascii wide nocase
        $alias_3 = "trojan.bunitu" ascii wide nocase
        $alias_4 = "win32/bunitu" ascii wide nocase
        $alias_5 = "bunitu proxy bot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUNITU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bunitu tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bunitu"
        date = "2026-10-16"
    strings:
        $attrib_str = "bunitu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bunndle (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bunndle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUNNDLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bunndle (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bunndle"
        date = "2026-10-16"
    strings:
        $fam_name = "bunndle" ascii wide nocase
        $alias_1 = "trojan:win32/bunndle" ascii wide nocase
        $alias_2 = "trojan.win32.bunndle" ascii wide nocase
        $alias_3 = "win32/bunndle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUNNDLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bunndle tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bunndle"
        date = "2026-10-16"
    strings:
        $attrib_str = "bunndle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Burden (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/burden
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BURDEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Burden (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/burden"
        date = "2026-10-16"
    strings:
        $fam_name = "burden" ascii wide nocase
        $alias_1 = "trojan.burden" ascii wide nocase
        $alias_2 = "downloader.burden" ascii wide nocase
        $alias_3 = "win32/burden" ascii wide nocase
        $alias_4 = "ransom:win32/burden" ascii wide nocase
        $alias_5 = "ransom.win32.burden" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BURDEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Burden tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/burden"
        date = "2026-10-16"
    strings:
        $attrib_str = "burden" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Burnwoo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/burnwoo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BURNWOO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Burnwoo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/burnwoo"
        date = "2026-10-16"
    strings:
        $fam_name = "burnwoo" ascii wide nocase
        $alias_1 = "trojan.burnwoo" ascii wide nocase
        $alias_2 = "downloader.burnwoo" ascii wide nocase
        $alias_3 = "win32/burnwoo" ascii wide nocase
        $alias_4 = "ransom:win32/burnwoo" ascii wide nocase
        $alias_5 = "ransom.win32.burnwoo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BURNWOO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Burnwoo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/burnwoo"
        date = "2026-10-16"
    strings:
        $attrib_str = "burnwoo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Busky (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/busky
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUSKY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Busky (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/busky"
        date = "2026-10-16"
    strings:
        $fam_name = "busky" ascii wide nocase
        $alias_1 = "ransom:win32/busky" ascii wide nocase
        $alias_2 = "ransom.win32.busky" ascii wide nocase
        $alias_3 = "win32/busky" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUSKY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Busky tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/busky"
        date = "2026-10-16"
    strings:
        $attrib_str = "busky" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bustem (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bustem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUSTEM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bustem (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bustem"
        date = "2026-10-16"
    strings:
        $fam_name = "bustem" ascii wide nocase
        $alias_1 = "ransom:win32/bustem" ascii wide nocase
        $alias_2 = "ransom.win32.bustem" ascii wide nocase
        $alias_3 = "win32/bustem" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUSTEM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bustem tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bustem"
        date = "2026-10-16"
    strings:
        $attrib_str = "bustem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Buterat (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/buterat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUTERAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Buterat (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/buterat"
        date = "2026-10-16"
    strings:
        $fam_name = "buterat" ascii wide nocase
        $alias_1 = "backdoor:win32/buterat" ascii wide nocase
        $alias_2 = "backdoor.win32.buterat" ascii wide nocase
        $alias_3 = "trojan:win32/buterat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUTERAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Buterat tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/buterat"
        date = "2026-10-16"
    strings:
        $attrib_str = "buterat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Buzus (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/buzus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUZUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Buzus (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/buzus"
        date = "2026-10-16"
    strings:
        $fam_name = "buzus" ascii wide nocase
        $alias_1 = "trojan:win32/buzus" ascii wide nocase
        $alias_2 = "trojan.win32.buzus" ascii wide nocase
        $alias_3 = "trojan.buzus" ascii wide nocase
        $alias_4 = "trojan:win32/buzus.c" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUZUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Buzus tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/buzus"
        date = "2026-10-16"
    strings:
        $attrib_str = "buzus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Buzy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/buzy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUZY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Buzy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/buzy"
        date = "2026-10-16"
    strings:
        $fam_name = "buzy" ascii wide nocase
        $alias_1 = "ransom:win32/buzy" ascii wide nocase
        $alias_2 = "ransom.win32.buzy" ascii wide nocase
        $alias_3 = "win32/buzy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUZY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Buzy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/buzy"
        date = "2026-10-16"
    strings:
        $attrib_str = "buzy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bwod (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bwod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BWOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bwod (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bwod"
        date = "2026-10-16"
    strings:
        $fam_name = "bwod" ascii wide nocase
        $alias_1 = "ransom:win32/bwod" ascii wide nocase
        $alias_2 = "ransom.win32.bwod" ascii wide nocase
        $alias_3 = "win32/bwod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BWOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bwod tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bwod"
        date = "2026-10-16"
    strings:
        $attrib_str = "bwod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Bybz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bybz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BYBZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bybz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bybz"
        date = "2026-10-16"
    strings:
        $fam_name = "bybz" ascii wide nocase
        $alias_1 = "ransom:win32/bybz" ascii wide nocase
        $alias_2 = "ransom.win32.bybz" ascii wide nocase
        $alias_3 = "win32/bybz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BYBZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bybz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bybz"
        date = "2026-10-16"
    strings:
        $attrib_str = "bybz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Byfh (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/byfh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BYFH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Byfh (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/byfh"
        date = "2026-10-16"
    strings:
        $fam_name = "byfh" ascii wide nocase
        $alias_1 = "trojan:win32/byfh!rfn" ascii wide nocase
        $alias_2 = "trojan.byfh" ascii wide nocase
        $alias_3 = "win32/byfh" ascii wide nocase
        $alias_4 = "adware:win32/byfh" ascii wide nocase
        $alias_5 = "trojan:win32/byfh.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BYFH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Byfh tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/byfh"
        date = "2026-10-16"
    strings:
        $attrib_str = "byfh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bypass (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bypass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BYPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bypass (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bypass"
        date = "2026-10-16"
    strings:
        $fam_name = "bypass" ascii wide nocase
        $alias_1 = "hacktool.bypass" ascii wide nocase
        $alias_2 = "exploit.uacbypass" ascii wide nocase
        $alias_3 = "tool.evasion" ascii wide nocase
        $alias_4 = "riskware.bypass" ascii wide nocase
        $alias_5 = "pws:win32/bypass" ascii wide nocase
        $alias_6 = "pws.win32.bypass" ascii wide nocase
        $alias_7 = "win32/bypass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BYPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bypass tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bypass"
        date = "2026-10-16"
    strings:
        $attrib_str = "bypass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bypassuac (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bypassuac
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BYPASSUAC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bypassuac (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bypassuac"
        date = "2026-10-16"
    strings:
        $fam_name = "bypassuac" ascii wide nocase
        $alias_1 = "hacktool:win32/bypassuac" ascii wide nocase
        $alias_2 = "behavior:win32/bypassuac" ascii wide nocase
        $alias_3 = "trojan:win32/bypassuac" ascii wide nocase
        $alias_4 = "tool:win32/bypassuac" ascii wide nocase
        $alias_5 = "win32/bypassuac" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BYPASSUAC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bypassuac tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bypassuac"
        date = "2026-10-16"
    strings:
        $attrib_str = "bypassuac" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Bytefence (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bytefence
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BYTEFENCE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bytefence (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bytefence"
        date = "2026-10-16"
    strings:
        $fam_name = "bytefence" ascii wide nocase
        $alias_1 = "trojan:win32/bytefence" ascii wide nocase
        $alias_2 = "trojan.win32.bytefence" ascii wide nocase
        $alias_3 = "win32/bytefence" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BYTEFENCE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bytefence tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bytefence"
        date = "2026-10-16"
    strings:
        $attrib_str = "bytefence" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bzub (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bzub
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BZUB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bzub (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bzub"
        date = "2026-10-16"
    strings:
        $fam_name = "bzub" ascii wide nocase
        $alias_1 = "trojan:win32/bzub" ascii wide nocase
        $alias_2 = "trojan.win32.bzub" ascii wide nocase
        $alias_3 = "win32/bzub" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BZUB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bzub tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bzub"
        date = "2026-10-16"
    strings:
        $attrib_str = "bzub" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Caae34Dd (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/caae34dd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CAAE34DD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Caae34Dd (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/caae34dd"
        date = "2026-10-16"
    strings:
        $fam_name = "caae34dd" ascii wide nocase
        $alias_1 = "trojan.obfuscated.gen" ascii wide nocase
        $alias_2 = "dropper.randomhash" ascii wide nocase
        $alias_3 = "win32/trojan.packer" ascii wide nocase
        $alias_4 = "ransom:win32/caae34dd" ascii wide nocase
        $alias_5 = "ransom.win32.caae34dd" ascii wide nocase
        $alias_6 = "win32/caae34dd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CAAE34DD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Caae34Dd tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/caae34dd"
        date = "2026-10-16"
    strings:
        $attrib_str = "caae34dd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cachedis (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cachedis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CACHEDIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cachedis (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cachedis"
        date = "2026-10-16"
    strings:
        $fam_name = "cachedis" ascii wide nocase
        $alias_1 = "trojan.cachedis" ascii wide nocase
        $alias_2 = "downloader.cachedis" ascii wide nocase
        $alias_3 = "win32/cachedis" ascii wide nocase
        $alias_4 = "ransom:win32/cachedis" ascii wide nocase
        $alias_5 = "ransom.win32.cachedis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CACHEDIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cachedis tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cachedis"
        date = "2026-10-16"
    strings:
        $attrib_str = "cachedis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cafecup (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cafecup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CAFECUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cafecup (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cafecup"
        date = "2026-10-16"
    strings:
        $fam_name = "cafecup" ascii wide nocase
        $alias_1 = "ransom:win32/cafecup" ascii wide nocase
        $alias_2 = "ransom.win32.cafecup" ascii wide nocase
        $alias_3 = "win32/cafecup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CAFECUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cafecup tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cafecup"
        date = "2026-10-16"
    strings:
        $attrib_str = "cafecup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cakl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cakl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CAKL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cakl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cakl"
        date = "2026-10-16"
    strings:
        $fam_name = "cakl" ascii wide nocase
        $alias_1 = "ransom:win32/cakl" ascii wide nocase
        $alias_2 = "ransom.win32.cakl" ascii wide nocase
        $alias_3 = "win32/cakl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CAKL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cakl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cakl"
        date = "2026-10-16"
    strings:
        $attrib_str = "cakl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cambot (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cambot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CAMBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cambot (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cambot"
        date = "2026-10-16"
    strings:
        $fam_name = "cambot" ascii wide nocase
        $alias_1 = "worm:win32/cambot" ascii wide nocase
        $alias_2 = "backdoor:win32/cambot" ascii wide nocase
        $alias_3 = "trojan:win32/cambot" ascii wide nocase
        $alias_4 = "worm:win32/cambot.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CAMBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cambot tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cambot"
        date = "2026-10-16"
    strings:
        $attrib_str = "cambot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Canbis (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/canbis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CANBIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Canbis (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/canbis"
        date = "2026-10-16"
    strings:
        $fam_name = "canbis" ascii wide nocase
        $alias_1 = "ransom:win32/canbis" ascii wide nocase
        $alias_2 = "ransom.win32.canbis" ascii wide nocase
        $alias_3 = "win32/canbis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CANBIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Canbis tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/canbis"
        date = "2026-10-16"
    strings:
        $attrib_str = "canbis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Candybox (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/candybox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CANDYBOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Candybox (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/candybox"
        date = "2026-10-16"
    strings:
        $fam_name = "candybox" ascii wide nocase
        $alias_1 = "ransom:win32/candybox" ascii wide nocase
        $alias_2 = "ransom.win32.candybox" ascii wide nocase
        $alias_3 = "win32/candybox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CANDYBOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Candybox tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/candybox"
        date = "2026-10-16"
    strings:
        $attrib_str = "candybox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Candyopen (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/candyopen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CANDYOPEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Candyopen (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/candyopen"
        date = "2026-10-16"
    strings:
        $fam_name = "candyopen" ascii wide nocase
        $alias_1 = "trojan:win32/candyopen" ascii wide nocase
        $alias_2 = "trojan.win32.candyopen" ascii wide nocase
        $alias_3 = "win32/candyopen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CANDYOPEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Candyopen tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/candyopen"
        date = "2026-10-16"
    strings:
        $attrib_str = "candyopen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Capredeam (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/capredeam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CAPREDEAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Capredeam (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/capredeam"
        date = "2026-10-16"
    strings:
        $fam_name = "capredeam" ascii wide nocase
        $alias_1 = "ransom:win32/capredeam" ascii wide nocase
        $alias_2 = "ransom.win32.capredeam" ascii wide nocase
        $alias_3 = "win32/capredeam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CAPREDEAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Capredeam tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/capredeam"
        date = "2026-10-16"
    strings:
        $attrib_str = "capredeam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Capsfin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/capsfin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CAPSFIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Capsfin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/capsfin"
        date = "2026-10-16"
    strings:
        $fam_name = "capsfin" ascii wide nocase
        $alias_1 = "ransom:win32/capsfin" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.capsfin" ascii wide nocase
        $alias_3 = "win32/capsfin" ascii wide nocase
        $alias_4 = "ransom.capsfin" ascii wide nocase
        $alias_5 = "capsfin ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CAPSFIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Capsfin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/capsfin"
        date = "2026-10-16"
    strings:
        $attrib_str = "capsfin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Carambisdu (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/carambisdu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CARAMBISDU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Carambisdu (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/carambisdu"
        date = "2026-10-16"
    strings:
        $fam_name = "carambisdu" ascii wide nocase
        $alias_1 = "trojan:win32/carambisdu" ascii wide nocase
        $alias_2 = "trojan.win32.carambisdu" ascii wide nocase
        $alias_3 = "win32/carambisdu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CARAMBISDU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Carambisdu tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/carambisdu"
        date = "2026-10-16"
    strings:
        $attrib_str = "carambisdu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Carbanak (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/carbanak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CARBANAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Carbanak (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/carbanak"
        date = "2026-10-16"
    strings:
        $fam_name = "carbanak" ascii wide nocase
        $alias_1 = "carbanak" ascii wide nocase
        $alias_2 = "anunak" ascii wide nocase
        $alias_3 = "fin7 toolkit" ascii wide nocase
        $alias_4 = "trojan.carbanak" ascii wide nocase
        $alias_5 = "win32/carbanak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CARBANAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Carbanak tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/carbanak"
        date = "2026-10-16"
    strings:
        $attrib_str = "carbanak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Carberp (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/carberp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CARBERP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Carberp (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/carberp"
        date = "2026-10-16"
    strings:
        $fam_name = "carberp" ascii wide nocase
        $alias_1 = "carberp" ascii wide nocase
        $alias_2 = "trojan.carberp" ascii wide nocase
        $alias_3 = "win32/carberp" ascii wide nocase
        $alias_4 = "backdoor.carberp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CARBERP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Carberp tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/carberp"
        date = "2026-10-16"
    strings:
        $attrib_str = "carberp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cardinal (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cardinal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CARDINAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cardinal (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cardinal"
        date = "2026-10-16"
    strings:
        $fam_name = "cardinal" ascii wide nocase
        $alias_1 = "ransom:win32/cardinal" ascii wide nocase
        $alias_2 = "ransom.win32.cardinal" ascii wide nocase
        $alias_3 = "win32/cardinal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CARDINAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cardinal tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cardinal"
        date = "2026-10-16"
    strings:
        $attrib_str = "cardinal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cardspy (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cardspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CARDSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cardspy (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cardspy"
        date = "2026-10-16"
    strings:
        $fam_name = "cardspy" ascii wide nocase
        $alias_1 = "trojan:win32/cardspy" ascii wide nocase
        $alias_2 = "trojan.win32.cardspy" ascii wide nocase
        $alias_3 = "pws:win32/cardspy" ascii wide nocase
        $alias_4 = "win32/cardspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CARDSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cardspy tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cardspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "cardspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cardtool (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cardtool
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CARDTOOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cardtool (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cardtool"
        date = "2026-10-16"
    strings:
        $fam_name = "cardtool" ascii wide nocase
        $alias_1 = "hacktool.cardtool" ascii wide nocase
        $alias_2 = "riskware.carder" ascii wide nocase
        $alias_3 = "tool.ccchecker" ascii wide nocase
        $alias_4 = "trojan:win32/cardtool" ascii wide nocase
        $alias_5 = "trojan.win32.cardtool" ascii wide nocase
        $alias_6 = "win32/cardtool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CARDTOOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cardtool tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cardtool"
        date = "2026-10-16"
    strings:
        $attrib_str = "cardtool" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Carrobat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/carrobat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CARROBAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Carrobat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/carrobat"
        date = "2026-10-16"
    strings:
        $fam_name = "carrobat" ascii wide nocase
        $alias_1 = "trojan.carrobat" ascii wide nocase
        $alias_2 = "downloader.carrobat" ascii wide nocase
        $alias_3 = "win32/carrobat" ascii wide nocase
        $alias_4 = "ransom:win32/carrobat" ascii wide nocase
        $alias_5 = "ransom.win32.carrobat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CARROBAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Carrobat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/carrobat"
        date = "2026-10-16"
    strings:
        $attrib_str = "carrobat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Casbaneiro (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/casbaneiro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CASBANEIRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Casbaneiro (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/casbaneiro"
        date = "2026-10-16"
    strings:
        $fam_name = "casbaneiro" ascii wide nocase
        $alias_1 = "trojan:win32/casbaneiro" ascii wide nocase
        $alias_2 = "trojan.win32.casbaneiro" ascii wide nocase
        $alias_3 = "win32/casbaneiro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CASBANEIRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Casbaneiro tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/casbaneiro"
        date = "2026-10-16"
    strings:
        $attrib_str = "casbaneiro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cashfiesta (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cashfiesta
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CASHFIESTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cashfiesta (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cashfiesta"
        date = "2026-10-16"
    strings:
        $fam_name = "cashfiesta" ascii wide nocase
        $alias_1 = "adware.cashfiesta" ascii wide nocase
        $alias_2 = "spyware.cashfiesta" ascii wide nocase
        $alias_3 = "win32/cashfiesta" ascii wide nocase
        $alias_4 = "trojan:win32/cashfiesta" ascii wide nocase
        $alias_5 = "trojan.win32.cashfiesta" ascii wide nocase
        $alias_6 = "win32/cashfiesta" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CASHFIESTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cashfiesta tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cashfiesta"
        date = "2026-10-16"
    strings:
        $attrib_str = "cashfiesta" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Casinoonline (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/casinoonline
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CASINOONLINE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Casinoonline (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/casinoonline"
        date = "2026-10-16"
    strings:
        $fam_name = "casinoonline" ascii wide nocase
        $alias_1 = "trojan:win32/casinoonline" ascii wide nocase
        $alias_2 = "trojan.win32.casinoonline" ascii wide nocase
        $alias_3 = "win32/casinoonline" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CASINOONLINE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Casinoonline tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/casinoonline"
        date = "2026-10-16"
    strings:
        $attrib_str = "casinoonline" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Casper (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/casper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CASPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Casper (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/casper"
        date = "2026-10-16"
    strings:
        $fam_name = "casper" ascii wide nocase
        $alias_1 = "babar-casper" ascii wide nocase
        $alias_2 = "animal farm casper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CASPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Casper tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/casper"
        date = "2026-10-16"
    strings:
        $attrib_str = "casper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cassiopeia (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cassiopeia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CASSIOPEIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cassiopeia (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cassiopeia"
        date = "2026-10-16"
    strings:
        $fam_name = "cassiopeia" ascii wide nocase
        $alias_1 = "backdoor:win32/cassiopeia" ascii wide nocase
        $alias_2 = "bkdr_cassiopeia.a" ascii wide nocase
        $alias_3 = "trojan:win32/cassiopeia" ascii wide nocase
        $alias_4 = "win32/cassiopeia" ascii wide nocase
        $alias_5 = "trojan.cassiopeia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CASSIOPEIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cassiopeia tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cassiopeia"
        date = "2026-10-16"
    strings:
        $attrib_str = "cassiopeia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Catalina (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/catalina
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CATALINA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Catalina (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/catalina"
        date = "2026-10-16"
    strings:
        $fam_name = "catalina" ascii wide nocase
        $alias_1 = "trojan:win32/catalina" ascii wide nocase
        $alias_2 = "trojan.win32.catalina" ascii wide nocase
        $alias_3 = "win32/catalina" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CATALINA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Catalina tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/catalina"
        date = "2026-10-16"
    strings:
        $attrib_str = "catalina" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Caxnet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/caxnet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CAXNET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Caxnet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/caxnet"
        date = "2026-10-16"
    strings:
        $fam_name = "caxnet" ascii wide nocase
        $alias_1 = "trojan.caxnet" ascii wide nocase
        $alias_2 = "downloader.caxnet" ascii wide nocase
        $alias_3 = "win32/caxnet" ascii wide nocase
        $alias_4 = "ransom:win32/caxnet" ascii wide nocase
        $alias_5 = "ransom.win32.caxnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CAXNET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Caxnet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/caxnet"
        date = "2026-10-16"
    strings:
        $attrib_str = "caxnet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cbot"
        date = "2026-10-16"
    strings:
        $fam_name = "cbot" ascii wide nocase
        $alias_1 = "ransom:win32/cbot" ascii wide nocase
        $alias_2 = "ransom.win32.cbot" ascii wide nocase
        $alias_3 = "win32/cbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "cbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cdnhelper (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cdnhelper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CDNHELPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cdnhelper (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cdnhelper"
        date = "2026-10-16"
    strings:
        $fam_name = "cdnhelper" ascii wide nocase
        $alias_1 = "adware.cdnhelper" ascii wide nocase
        $alias_2 = "pup.cdnhelper" ascii wide nocase
        $alias_3 = "browsermodifier:win32/cdnhelper" ascii wide nocase
        $alias_4 = "ransom:win32/cdnhelper" ascii wide nocase
        $alias_5 = "ransom.win32.cdnhelper" ascii wide nocase
        $alias_6 = "win32/cdnhelper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CDNHELPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cdnhelper tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cdnhelper"
        date = "2026-10-16"
    strings:
        $attrib_str = "cdnhelper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cdvq (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cdvq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CDVQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cdvq (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cdvq"
        date = "2026-10-16"
    strings:
        $fam_name = "cdvq" ascii wide nocase
        $alias_1 = "ransom:win32/cdvq" ascii wide nocase
        $alias_2 = "ransom.win32.cdvq" ascii wide nocase
        $alias_3 = "win32/cdvq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CDVQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cdvq tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cdvq"
        date = "2026-10-16"
    strings:
        $attrib_str = "cdvq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cebot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cebot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CEBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cebot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cebot"
        date = "2026-10-16"
    strings:
        $fam_name = "cebot" ascii wide nocase
        $alias_1 = "ransom:win32/cebot" ascii wide nocase
        $alias_2 = "ransom.win32.cebot" ascii wide nocase
        $alias_3 = "win32/cebot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CEBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cebot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cebot"
        date = "2026-10-16"
    strings:
        $attrib_str = "cebot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ceckno (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ceckno
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CECKNO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ceckno (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ceckno"
        date = "2026-10-16"
    strings:
        $fam_name = "ceckno" ascii wide nocase
        $alias_1 = "ransom:win32/ceckno" ascii wide nocase
        $alias_2 = "ransom.win32.ceckno" ascii wide nocase
        $alias_3 = "win32/ceckno" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CECKNO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ceckno tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ceckno"
        date = "2026-10-16"
    strings:
        $attrib_str = "ceckno" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ceeinject (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ceeinject
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CEEINJECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ceeinject (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ceeinject"
        date = "2026-10-16"
    strings:
        $fam_name = "ceeinject" ascii wide nocase
        $alias_1 = "virtool:win32/ceeinject" ascii wide nocase
        $alias_2 = "trojan:win32/ceeinject" ascii wide nocase
        $alias_3 = "ceeinject.gen" ascii wide nocase
        $alias_4 = "win32/ceeinject" ascii wide nocase
        $alias_5 = "virtool:win32/ceeinject.gen!a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CEEINJECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ceeinject tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ceeinject"
        date = "2026-10-16"
    strings:
        $attrib_str = "ceeinject" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cekar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cekar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CEKAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cekar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cekar"
        date = "2026-10-16"
    strings:
        $fam_name = "cekar" ascii wide nocase
        $alias_1 = "ransom:win32/cekar" ascii wide nocase
        $alias_2 = "ransom.win32.cekar" ascii wide nocase
        $alias_3 = "win32/cekar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CEKAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cekar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cekar"
        date = "2026-10-16"
    strings:
        $attrib_str = "cekar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Celesty (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/celesty
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CELESTY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Celesty (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/celesty"
        date = "2026-10-16"
    strings:
        $fam_name = "celesty" ascii wide nocase
        $alias_1 = "celesty binder" ascii wide nocase
        $alias_2 = "celesty rat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CELESTY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Celesty tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/celesty"
        date = "2026-10-16"
    strings:
        $attrib_str = "celesty" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Centrumdownloader (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/centrumdownloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CENTRUMDOWNLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Centrumdownloader (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/centrumdownloader"
        date = "2026-10-16"
    strings:
        $fam_name = "centrumdownloader" ascii wide nocase
        $alias_1 = "trojandownloader:win32/centrumdownloader" ascii wide nocase
        $alias_2 = "trojan:win32/centrumdownloader" ascii wide nocase
        $alias_3 = "dropper.centrum" ascii wide nocase
        $alias_4 = "win32/centrumdownloader" ascii wide nocase
        $alias_5 = "trojandownloader:win32/centrumdownloader.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CENTRUMDOWNLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Centrumdownloader tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/centrumdownloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "centrumdownloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Centrumloader (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/centrumloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CENTRUMLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Centrumloader (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/centrumloader"
        date = "2026-10-16"
    strings:
        $fam_name = "centrumloader" ascii wide nocase
        $alias_1 = "trojandownloader:win32/centrumloader" ascii wide nocase
        $alias_2 = "trojandownloader.win32.centrumloader" ascii wide nocase
        $alias_3 = "win32/centrumloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CENTRUMLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Centrumloader tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/centrumloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "centrumloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ceram (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ceram
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CERAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ceram (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ceram"
        date = "2026-10-16"
    strings:
        $fam_name = "ceram" ascii wide nocase
        $alias_1 = "trojan.ceram" ascii wide nocase
        $alias_2 = "downloader.ceram" ascii wide nocase
        $alias_3 = "win32/ceram" ascii wide nocase
        $alias_4 = "ransom:win32/ceram" ascii wide nocase
        $alias_5 = "ransom.win32.ceram" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CERAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ceram tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ceram"
        date = "2026-10-16"
    strings:
        $attrib_str = "ceram" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cerber (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cerber
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CERBER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cerber (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cerber"
        date = "2026-10-16"
    strings:
        $fam_name = "cerber" ascii wide nocase
        $alias_1 = "cerber" ascii wide nocase
        $alias_2 = "cerber3" ascii wide nocase
        $alias_3 = "cerber4" ascii wide nocase
        $alias_4 = "cerber5" ascii wide nocase
        $alias_5 = "cerberus_ransom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CERBER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cerber tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cerber"
        date = "2026-10-16"
    strings:
        $attrib_str = "cerber" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cerberus (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cerberus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CERBERUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cerberus (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cerberus"
        date = "2026-10-16"
    strings:
        $fam_name = "cerberus" ascii wide nocase
        $alias_1 = "android.cerberus" ascii wide nocase
        $alias_2 = "cerberus banking trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CERBERUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cerberus tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cerberus"
        date = "2026-10-16"
    strings:
        $attrib_str = "cerberus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cerbu (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cerbu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CERBU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cerbu (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cerbu"
        date = "2026-10-16"
    strings:
        $fam_name = "cerbu" ascii wide nocase
        $alias_1 = "backdoor:win32/cerbu" ascii wide nocase
        $alias_2 = "trojan:win32/cerbu" ascii wide nocase
        $alias_3 = "win32/cerbu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CERBU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cerbu tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cerbu"
        date = "2026-10-16"
    strings:
        $attrib_str = "cerbu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Cfms (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cfms
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CFMS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cfms (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cfms"
        date = "2026-10-16"
    strings:
        $fam_name = "cfms" ascii wide nocase
        $alias_1 = "trojan.cfms" ascii wide nocase
        $alias_2 = "downloader.cfms" ascii wide nocase
        $alias_3 = "win32/cfms" ascii wide nocase
        $alias_4 = "ransom:win32/cfms" ascii wide nocase
        $alias_5 = "ransom.win32.cfms" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CFMS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cfms tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cfms"
        date = "2026-10-16"
    strings:
        $attrib_str = "cfms" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cgmu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cgmu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CGMU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cgmu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cgmu"
        date = "2026-10-16"
    strings:
        $fam_name = "cgmu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CGMU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cgmu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cgmu"
        date = "2026-10-16"
    strings:
        $attrib_str = "cgmu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chanitor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chanitor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHANITOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chanitor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chanitor"
        date = "2026-10-16"
    strings:
        $fam_name = "chanitor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHANITOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chanitor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chanitor"
        date = "2026-10-16"
    strings:
        $attrib_str = "chanitor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chapak (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chapak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHAPAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chapak (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chapak"
        date = "2026-10-16"
    strings:
        $fam_name = "chapak" ascii wide nocase
        $alias_1 = "chapak" ascii wide nocase
        $alias_2 = "trojandownloader:win32/chapak" ascii wide nocase
        $alias_3 = "trojan.chapak" ascii wide nocase
        $alias_4 = "win32/chapak" ascii wide nocase
        $alias_5 = "downloader.chapak" ascii wide nocase
        $alias_6 = "trojan.win32.chapak" ascii wide nocase
        $alias_7 = "chapak downloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHAPAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chapak tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chapak"
        date = "2026-10-16"
    strings:
        $attrib_str = "chapak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Chatzum (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chatzum
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHATZUM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chatzum (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chatzum"
        date = "2026-10-16"
    strings:
        $fam_name = "chatzum" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHATZUM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chatzum tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chatzum"
        date = "2026-10-16"
    strings:
        $attrib_str = "chatzum" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cheatengine (Pua_Tool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cheatengine
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHEATENGINE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cheatengine (Pua_Tool)"
        category = "Pua_Tool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cheatengine"
        date = "2026-10-16"
    strings:
        $fam_name = "cheatengine" ascii wide nocase
        $alias_1 = "hacktool:win32/cheatengine" ascii wide nocase
        $alias_2 = "pua:win32/cheatengine" ascii wide nocase
        $alias_3 = "riskware.cheatengine" ascii wide nocase
        $alias_4 = "tool:win32/cheatengine" ascii wide nocase
        $alias_5 = "cheat engine" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHEATENGINE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cheatengine tradecraft"
        category = "Pua_Tool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cheatengine"
        date = "2026-10-16"
    strings:
        $attrib_str = "cheatengine" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Chekafev (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chekafev
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHEKAFEV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chekafev (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chekafev"
        date = "2026-10-16"
    strings:
        $fam_name = "chekafev" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHEKAFEV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chekafev tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chekafev"
        date = "2026-10-16"
    strings:
        $attrib_str = "chekafev" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chepdu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chepdu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHEPDU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chepdu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chepdu"
        date = "2026-10-16"
    strings:
        $fam_name = "chepdu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHEPDU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chepdu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chepdu"
        date = "2026-10-16"
    strings:
        $attrib_str = "chepdu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chepro (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chepro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHEPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chepro (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chepro"
        date = "2026-10-16"
    strings:
        $fam_name = "chepro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHEPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chepro tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chepro"
        date = "2026-10-16"
    strings:
        $attrib_str = "chepro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chextad (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chextad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHEXTAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chextad (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chextad"
        date = "2026-10-16"
    strings:
        $fam_name = "chextad" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHEXTAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chextad tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chextad"
        date = "2026-10-16"
    strings:
        $attrib_str = "chextad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chifrax (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chifrax
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHIFRAX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chifrax (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chifrax"
        date = "2026-10-16"
    strings:
        $fam_name = "chifrax" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHIFRAX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chifrax tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chifrax"
        date = "2026-10-16"
    strings:
        $attrib_str = "chifrax" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chimera (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chimera
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHIMERA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chimera (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chimera"
        date = "2026-10-16"
    strings:
        $fam_name = "chimera" ascii wide nocase
        $alias_1 = "ransomware.chimera" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.chimera" ascii wide nocase
        $alias_3 = "extortion.chimera" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHIMERA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chimera tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chimera"
        date = "2026-10-16"
    strings:
        $attrib_str = "chimera" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chinad (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chinad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHINAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chinad (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chinad"
        date = "2026-10-16"
    strings:
        $fam_name = "chinad" ascii wide nocase
        $alias_1 = "adware.chinaad" ascii wide nocase
        $alias_2 = "spyware.chinad" ascii wide nocase
        $alias_3 = "pup.chinaad" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHINAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chinad tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chinad"
        date = "2026-10-16"
    strings:
        $attrib_str = "chinad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chinbo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chinbo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHINBO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chinbo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chinbo"
        date = "2026-10-16"
    strings:
        $fam_name = "chinbo" ascii wide nocase
        $alias_1 = "trojan.chinbo" ascii wide nocase
        $alias_2 = "downloader.chinbo" ascii wide nocase
        $alias_3 = "win32/chinbo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHINBO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chinbo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chinbo"
        date = "2026-10-16"
    strings:
        $attrib_str = "chinbo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chindo (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chindo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHINDO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chindo (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chindo"
        date = "2026-10-16"
    strings:
        $fam_name = "chindo" ascii wide nocase
        $alias_1 = "worm:win32/chindo" ascii wide nocase
        $alias_2 = "trojan:win32/chindo" ascii wide nocase
        $alias_3 = "win32/chindo" ascii wide nocase
        $alias_4 = "worm:win32/chindo.sq!mtb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHINDO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chindo tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chindo"
        date = "2026-10-16"
    strings:
        $attrib_str = "chindo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Chir (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chir
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHIR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chir (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chir"
        date = "2026-10-16"
    strings:
        $fam_name = "chir" ascii wide nocase
        $alias_1 = "virus:win32/chir.b@mm" ascii wide nocase
        $alias_2 = "w32.chir" ascii wide nocase
        $alias_3 = "runouce" ascii wide nocase
        $alias_4 = "worm:win32/chir" ascii wide nocase
        $alias_5 = "w32.chir.b@mm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHIR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chir tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chir"
        date = "2026-10-16"
    strings:
        $attrib_str = "chir" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Chisburg (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chisburg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHISBURG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chisburg (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chisburg"
        date = "2026-10-16"
    strings:
        $fam_name = "chisburg" ascii wide nocase
        $alias_1 = "trojan-psw.win32.chisburg" ascii wide nocase
        $alias_2 = "pws:win32/chisburg" ascii wide nocase
        $alias_3 = "trojan.chisburg" ascii wide nocase
        $alias_4 = "win32/chisburg" ascii wide nocase
        $alias_5 = "trojan-psw:win32/chisburg.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHISBURG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chisburg tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chisburg"
        date = "2026-10-16"
    strings:
        $attrib_str = "chisburg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Chistudi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chistudi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHISTUDI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chistudi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chistudi"
        date = "2026-10-16"
    strings:
        $fam_name = "chistudi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHISTUDI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chistudi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chistudi"
        date = "2026-10-16"
    strings:
        $attrib_str = "chistudi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Chopper (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chopper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHOPPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chopper (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chopper"
        date = "2026-10-16"
    strings:
        $fam_name = "chopper" ascii wide nocase
        $alias_1 = "backdoor:win32/chopper" ascii wide nocase
        $alias_2 = "china chopper" ascii wide nocase
        $alias_3 = "trojan:asp/chopper" ascii wide nocase
        $alias_4 = "win32/chopper" ascii wide nocase
        $alias_5 = "china chopper web shell" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHOPPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chopper tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chopper"
        date = "2026-10-16"
    strings:
        $attrib_str = "chopper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Chromepass (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chromepass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHROMEPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chromepass (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chromepass"
        date = "2026-10-16"
    strings:
        $fam_name = "chromepass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHROMEPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chromepass tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chromepass"
        date = "2026-10-16"
    strings:
        $attrib_str = "chromepass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Chthonic (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chthonic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHTHONIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chthonic (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chthonic"
        date = "2026-10-16"
    strings:
        $fam_name = "chthonic" ascii wide nocase
        $alias_1 = "chthonic" ascii wide nocase
        $alias_2 = "trojan.chthonic" ascii wide nocase
        $alias_3 = "win32/chthonic" ascii wide nocase
        $alias_4 = "zeus chthonic" ascii wide nocase
        $alias_5 = "zbot.chthonic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHTHONIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chthonic tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chthonic"
        date = "2026-10-16"
    strings:
        $attrib_str = "chthonic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Chupik (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/chupik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CHUPIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Chupik (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chupik"
        date = "2026-10-16"
    strings:
        $fam_name = "chupik" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CHUPIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Chupik tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/chupik"
        date = "2026-10-16"
    strings:
        $attrib_str = "chupik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cia (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cia (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cia"
        date = "2026-10-16"
    strings:
        $fam_name = "cia" ascii wide nocase
        $alias_1 = "dos.cia" ascii wide nocase
        $alias_2 = "cia.virus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cia tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cia"
        date = "2026-10-16"
    strings:
        $attrib_str = "cia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ciadoor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ciadoor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CIADOOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ciadoor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ciadoor"
        date = "2026-10-16"
    strings:
        $fam_name = "ciadoor" ascii wide nocase
        $alias_1 = "backdoor.ciadoor" ascii wide nocase
        $alias_2 = "rat.ciadoor" ascii wide nocase
        $alias_3 = "win32/ciadoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CIADOOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ciadoor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ciadoor"
        date = "2026-10-16"
    strings:
        $attrib_str = "ciadoor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cidox (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cidox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CIDOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cidox (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cidox"
        date = "2026-10-16"
    strings:
        $fam_name = "cidox" ascii wide nocase
        $alias_1 = "rootkit.cidox" ascii wide nocase
        $alias_2 = "trojan.rovnix" ascii wide nocase
        $alias_3 = "bootkit.win32.cidox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CIDOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cidox tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cidox"
        date = "2026-10-16"
    strings:
        $attrib_str = "cidox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cinmus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cinmus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CINMUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cinmus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cinmus"
        date = "2026-10-16"
    strings:
        $fam_name = "cinmus" ascii wide nocase
        $alias_1 = "trojan.cinmus" ascii wide nocase
        $alias_2 = "downloader.cinmus" ascii wide nocase
        $alias_3 = "win32/cinmus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CINMUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cinmus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cinmus"
        date = "2026-10-16"
    strings:
        $attrib_str = "cinmus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Citeary (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/citeary
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CITEARY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Citeary (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/citeary"
        date = "2026-10-16"
    strings:
        $fam_name = "citeary" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CITEARY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Citeary tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/citeary"
        date = "2026-10-16"
    strings:
        $attrib_str = "citeary" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ciyaamgnrsg (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ciyaamgnrsg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CIYAAMGNRSG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ciyaamgnrsg (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ciyaamgnrsg"
        date = "2026-10-16"
    strings:
        $fam_name = "ciyaamgnrsg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CIYAAMGNRSG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ciyaamgnrsg tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ciyaamgnrsg"
        date = "2026-10-16"
    strings:
        $attrib_str = "ciyaamgnrsg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cjishu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cjishu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CJISHU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cjishu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cjishu"
        date = "2026-10-16"
    strings:
        $fam_name = "cjishu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CJISHU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cjishu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cjishu"
        date = "2026-10-16"
    strings:
        $attrib_str = "cjishu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cleaman (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cleaman
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLEAMAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cleaman (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cleaman"
        date = "2026-10-16"
    strings:
        $fam_name = "cleaman" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLEAMAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cleaman tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cleaman"
        date = "2026-10-16"
    strings:
        $attrib_str = "cleaman" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cleanlog (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cleanlog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLEANLOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cleanlog (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cleanlog"
        date = "2026-10-16"
    strings:
        $fam_name = "cleanlog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLEANLOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cleanlog tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cleanlog"
        date = "2026-10-16"
    strings:
        $attrib_str = "cleanlog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cleanpcpro (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cleanpcpro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLEANPCPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cleanpcpro (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cleanpcpro"
        date = "2026-10-16"
    strings:
        $fam_name = "cleanpcpro" ascii wide nocase
        $alias_1 = "rogue.cleanpcpro" ascii wide nocase
        $alias_2 = "pup.fakeoptimizer" ascii wide nocase
        $alias_3 = "scareware.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLEANPCPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cleanpcpro tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cleanpcpro"
        date = "2026-10-16"
    strings:
        $attrib_str = "cleanpcpro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Clearlog (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/clearlog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLEARLOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Clearlog (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clearlog"
        date = "2026-10-16"
    strings:
        $fam_name = "clearlog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLEARLOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Clearlog tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clearlog"
        date = "2026-10-16"
    strings:
        $attrib_str = "clearlog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Clearsearch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/clearsearch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLEARSEARCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Clearsearch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clearsearch"
        date = "2026-10-16"
    strings:
        $fam_name = "clearsearch" ascii wide nocase
        $alias_1 = "adware.clearsearch" ascii wide nocase
        $alias_2 = "browserhijacker.clearsearch" ascii wide nocase
        $alias_3 = "pup.clearsearch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLEARSEARCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Clearsearch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clearsearch"
        date = "2026-10-16"
    strings:
        $attrib_str = "clearsearch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Clhf (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/clhf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLHF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Clhf (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clhf"
        date = "2026-10-16"
    strings:
        $fam_name = "clhf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLHF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Clhf tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clhf"
        date = "2026-10-16"
    strings:
        $attrib_str = "clhf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Clickmein (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/clickmein
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLICKMEIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Clickmein (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clickmein"
        date = "2026-10-16"
    strings:
        $fam_name = "clickmein" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLICKMEIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Clickmein tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clickmein"
        date = "2026-10-16"
    strings:
        $attrib_str = "clickmein" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Clickshell (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/clickshell
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLICKSHELL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Clickshell (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clickshell"
        date = "2026-10-16"
    strings:
        $fam_name = "clickshell" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLICKSHELL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Clickshell tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clickshell"
        date = "2026-10-16"
    strings:
        $attrib_str = "clickshell" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Client (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/client
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLIENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Client (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/client"
        date = "2026-10-16"
    strings:
        $fam_name = "client" ascii wide nocase
        $alias_1 = "trojan.rat.client" ascii wide nocase
        $alias_2 = "backdoor.client" ascii wide nocase
        $alias_3 = "win32/client.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLIENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Client tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/client"
        date = "2026-10-16"
    strings:
        $attrib_str = "client" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Clipbanker (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/clipbanker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLIPBANKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Clipbanker (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clipbanker"
        date = "2026-10-16"
    strings:
        $fam_name = "clipbanker" ascii wide nocase
        $alias_1 = "trojan-banker.win32.clipbanker" ascii wide nocase
        $alias_2 = "trojan:win32/clipbanker" ascii wide nocase
        $alias_3 = "trojan.clipbanker" ascii wide nocase
        $alias_4 = "win32/clipbanker" ascii wide nocase
        $alias_5 = "clipbanker.gen" ascii wide nocase
        $alias_6 = "trojan-banker:win32/clipbanker.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLIPBANKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Clipbanker tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clipbanker"
        date = "2026-10-16"
    strings:
        $attrib_str = "clipbanker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Clipspy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/clipspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLIPSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Clipspy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clipspy"
        date = "2026-10-16"
    strings:
        $fam_name = "clipspy" ascii wide nocase
        $alias_1 = "riskware.clipspy" ascii wide nocase
        $alias_2 = "hacktool.clipboardmonitor" ascii wide nocase
        $alias_3 = "pup.clipspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLIPSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Clipspy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clipspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "clipspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cliptoshuffler (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cliptoshuffler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLIPTOSHUFFLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cliptoshuffler (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cliptoshuffler"
        date = "2026-10-16"
    strings:
        $fam_name = "cliptoshuffler" ascii wide nocase
        $alias_1 = "trojan.clipper" ascii wide nocase
        $alias_2 = "trojan.cointhief" ascii wide nocase
        $alias_3 = "win32/cliptoshuffler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLIPTOSHUFFLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cliptoshuffler tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cliptoshuffler"
        date = "2026-10-16"
    strings:
        $attrib_str = "cliptoshuffler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cloudguard (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cloudguard
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLOUDGUARD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cloudguard (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cloudguard"
        date = "2026-10-16"
    strings:
        $fam_name = "cloudguard" ascii wide nocase
        $alias_1 = "pua:win32/cloudguard" ascii wide nocase
        $alias_2 = "rogue:win32/cloudguard" ascii wide nocase
        $alias_3 = "program:win32/cloudguard" ascii wide nocase
        $alias_4 = "cloudguard antivirus" ascii wide nocase
        $alias_5 = "win32/cloudguard" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLOUDGUARD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cloudguard tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cloudguard"
        date = "2026-10-16"
    strings:
        $attrib_str = "cloudguard" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cloudscout (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cloudscout
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLOUDSCOUT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cloudscout (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cloudscout"
        date = "2026-10-16"
    strings:
        $fam_name = "cloudscout" ascii wide nocase
        $alias_1 = "trojan:win32/cloudscout" ascii wide nocase
        $alias_2 = "cloudscout" ascii wide nocase
        $alias_3 = "backdoor.cloudscout" ascii wide nocase
        $alias_4 = "evasive panda cloudscout" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLOUDSCOUT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cloudscout tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cloudscout"
        date = "2026-10-16"
    strings:
        $attrib_str = "cloudscout" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cloudwrapper (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cloudwrapper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLOUDWRAPPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cloudwrapper (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cloudwrapper"
        date = "2026-10-16"
    strings:
        $fam_name = "cloudwrapper" ascii wide nocase
        $alias_1 = "softwarebundler:win32/cloudwrapper" ascii wide nocase
        $alias_2 = "pua:win32/cloudwrapper" ascii wide nocase
        $alias_3 = "pup.optional.cloudwrapper" ascii wide nocase
        $alias_4 = "win32/cloudwrapper" ascii wide nocase
        $alias_5 = "adware.cloudwrapper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLOUDWRAPPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cloudwrapper tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cloudwrapper"
        date = "2026-10-16"
    strings:
        $attrib_str = "cloudwrapper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cloverplus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cloverplus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLOVERPLUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cloverplus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cloverplus"
        date = "2026-10-16"
    strings:
        $fam_name = "cloverplus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLOVERPLUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cloverplus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cloverplus"
        date = "2026-10-16"
    strings:
        $attrib_str = "cloverplus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cloxer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cloxer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLOXER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cloxer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cloxer"
        date = "2026-10-16"
    strings:
        $fam_name = "cloxer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLOXER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cloxer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cloxer"
        date = "2026-10-16"
    strings:
        $attrib_str = "cloxer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cmgfaeflb9E (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cmgfaeflb9e
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CMGFAEFLB9E_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cmgfaeflb9E (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cmgfaeflb9e"
        date = "2026-10-16"
    strings:
        $fam_name = "cmgfaeflb9e" ascii wide nocase
        $alias_1 = "trojan.obfuscated.gen" ascii wide nocase
        $alias_2 = "dropper.randomname" ascii wide nocase
        $alias_3 = "win32/trojan.packer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CMGFAEFLB9E_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cmgfaeflb9E tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cmgfaeflb9e"
        date = "2026-10-16"
    strings:
        $attrib_str = "cmgfaeflb9e" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cmhfbw9R (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cmhfbw9r
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CMHFBW9R_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cmhfbw9R (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cmhfbw9r"
        date = "2026-10-16"
    strings:
        $fam_name = "cmhfbw9r" ascii wide nocase
        $alias_1 = "trojan.generic.cmhfbw9r" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CMHFBW9R_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cmhfbw9R tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cmhfbw9r"
        date = "2026-10-16"
    strings:
        $attrib_str = "cmhfbw9r" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cmy3U (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cmy3u
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CMY3U_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cmy3U (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cmy3u"
        date = "2026-10-16"
    strings:
        $fam_name = "cmy3u" ascii wide nocase
        $alias_1 = "ransom:win32/cmy3u" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.cmy3u" ascii wide nocase
        $alias_3 = "win32/cmy3u" ascii wide nocase
        $alias_4 = "cmy3u ransomware" ascii wide nocase
        $alias_5 = "ransom.cmy3u" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CMY3U_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cmy3U tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cmy3u"
        date = "2026-10-16"
    strings:
        $attrib_str = "cmy3u" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cnbtech (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cnbtech
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CNBTECH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cnbtech (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cnbtech"
        date = "2026-10-16"
    strings:
        $fam_name = "cnbtech" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CNBTECH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cnbtech tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cnbtech"
        date = "2026-10-16"
    strings:
        $attrib_str = "cnbtech" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cnnic (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cnnic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CNNIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cnnic (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cnnic"
        date = "2026-10-16"
    strings:
        $fam_name = "cnnic" ascii wide nocase
        $alias_1 = "adware.cnnic" ascii wide nocase
        $alias_2 = "pup.cnnic" ascii wide nocase
        $alias_3 = "win32/cnnic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CNNIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cnnic tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cnnic"
        date = "2026-10-16"
    strings:
        $attrib_str = "cnnic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cnopa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cnopa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CNOPA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cnopa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cnopa"
        date = "2026-10-16"
    strings:
        $fam_name = "cnopa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CNOPA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cnopa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cnopa"
        date = "2026-10-16"
    strings:
        $attrib_str = "cnopa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cnsmin (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cnsmin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CNSMIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cnsmin (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cnsmin"
        date = "2026-10-16"
    strings:
        $fam_name = "cnsmin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CNSMIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cnsmin tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cnsmin"
        date = "2026-10-16"
    strings:
        $attrib_str = "cnsmin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cntads (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cntads
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CNTADS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cntads (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cntads"
        date = "2026-10-16"
    strings:
        $fam_name = "cntads" ascii wide nocase
        $alias_1 = "adware.cntads" ascii wide nocase
        $alias_2 = "pup.cntads" ascii wide nocase
        $alias_3 = "cntads adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CNTADS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cntads tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cntads"
        date = "2026-10-16"
    strings:
        $attrib_str = "cntads" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Coantor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/coantor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COANTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Coantor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coantor"
        date = "2026-10-16"
    strings:
        $fam_name = "coantor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COANTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Coantor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coantor"
        date = "2026-10-16"
    strings:
        $attrib_str = "coantor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cobalt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cobalt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COBALT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cobalt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cobalt"
        date = "2026-10-16"
    strings:
        $fam_name = "cobalt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COBALT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cobalt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cobalt"
        date = "2026-10-16"
    strings:
        $attrib_str = "cobalt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cobaltstrike (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cobaltstrike
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COBALTSTRIKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cobaltstrike (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cobaltstrike"
        date = "2026-10-16"
    strings:
        $fam_name = "cobaltstrike" ascii wide nocase
        $alias_1 = "cobalt strike beacon" ascii wide nocase
        $alias_2 = "cobaltstrike" ascii wide nocase
        $alias_3 = "beacon" ascii wide nocase
        $alias_4 = "hacktool:win32/cobaltstrike" ascii wide nocase
        $alias_5 = "trojan.cobaltstrike" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COBALTSTRIKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cobaltstrike tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cobaltstrike"
        date = "2026-10-16"
    strings:
        $attrib_str = "cobaltstrike" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cobra (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cobra
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COBRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cobra (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cobra"
        date = "2026-10-16"
    strings:
        $fam_name = "cobra" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COBRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cobra tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cobra"
        date = "2026-10-16"
    strings:
        $attrib_str = "cobra" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Coced (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/coced
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COCED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Coced (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coced"
        date = "2026-10-16"
    strings:
        $fam_name = "coced" ascii wide nocase
        $alias_1 = "trojan.coced" ascii wide nocase
        $alias_2 = "downloader.coced" ascii wide nocase
        $alias_3 = "win32/coced" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COCED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Coced tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coced"
        date = "2026-10-16"
    strings:
        $attrib_str = "coced" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Code (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/code
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CODE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Code (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/code"
        date = "2026-10-16"
    strings:
        $fam_name = "code" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CODE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Code tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/code"
        date = "2026-10-16"
    strings:
        $attrib_str = "code" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Codecpa (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/codecpa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CODECPA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Codecpa (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/codecpa"
        date = "2026-10-16"
    strings:
        $fam_name = "codecpa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CODECPA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Codecpa tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/codecpa"
        date = "2026-10-16"
    strings:
        $attrib_str = "codecpa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Codewall (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/codewall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CODEWALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Codewall (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/codewall"
        date = "2026-10-16"
    strings:
        $fam_name = "codewall" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CODEWALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Codewall tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/codewall"
        date = "2026-10-16"
    strings:
        $attrib_str = "codewall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Codiby (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/codiby
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CODIBY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Codiby (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/codiby"
        date = "2026-10-16"
    strings:
        $fam_name = "codiby" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CODIBY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Codiby tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/codiby"
        date = "2026-10-16"
    strings:
        $attrib_str = "codiby" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cognosads (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cognosads
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COGNOSADS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cognosads (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cognosads"
        date = "2026-10-16"
    strings:
        $fam_name = "cognosads" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COGNOSADS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cognosads tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cognosads"
        date = "2026-10-16"
    strings:
        $attrib_str = "cognosads" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Coinloader (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/coinloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COINLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Coinloader (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coinloader"
        date = "2026-10-16"
    strings:
        $fam_name = "coinloader" ascii wide nocase
        $alias_1 = "trojan.downloader.coinminer" ascii wide nocase
        $alias_2 = "riskware.coinloader" ascii wide nocase
        $alias_3 = "coinminer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COINLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Coinloader tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coinloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "coinloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Coins (Cryptominer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/coins
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COINS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Coins (Cryptominer)"
        category = "Cryptominer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coins"
        date = "2026-10-16"
    strings:
        $fam_name = "coins" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COINS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Coins tradecraft"
        category = "Cryptominer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coins"
        date = "2026-10-16"
    strings:
        $attrib_str = "coins" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Coinstealer (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/coinstealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COINSTEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Coinstealer (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coinstealer"
        date = "2026-10-16"
    strings:
        $fam_name = "coinstealer" ascii wide nocase
        $alias_1 = "trojan:win32/coinstealer" ascii wide nocase
        $alias_2 = "trojan:win32/coinstealer!rfn" ascii wide nocase
        $alias_3 = "trojan.coinstealer" ascii wide nocase
        $alias_4 = "win32/coinstealer" ascii wide nocase
        $alias_5 = "cryptostealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COINSTEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Coinstealer tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coinstealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "coinstealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Collector (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/collector
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COLLECTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Collector (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/collector"
        date = "2026-10-16"
    strings:
        $fam_name = "collector" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COLLECTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Collector tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/collector"
        date = "2026-10-16"
    strings:
        $attrib_str = "collector" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Coma (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/coma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Coma (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coma"
        date = "2026-10-16"
    strings:
        $fam_name = "coma" ascii wide nocase
        $alias_1 = "dos.coma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Coma tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coma"
        date = "2026-10-16"
    strings:
        $attrib_str = "coma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Comei (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/comei
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COMEI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Comei (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/comei"
        date = "2026-10-16"
    strings:
        $fam_name = "comei" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COMEI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Comei tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/comei"
        date = "2026-10-16"
    strings:
        $attrib_str = "comei" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cometer (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cometer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COMETER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cometer (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cometer"
        date = "2026-10-16"
    strings:
        $fam_name = "cometer" ascii wide nocase
        $alias_1 = "backdoor:win32/cometer" ascii wide nocase
        $alias_2 = "trojan:win32/cometer" ascii wide nocase
        $alias_3 = "backdoor.win32.cometer" ascii wide nocase
        $alias_4 = "win32/cometer" ascii wide nocase
        $alias_5 = "trojan.cometer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COMETER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cometer tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cometer"
        date = "2026-10-16"
    strings:
        $attrib_str = "cometer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Comine (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/comine
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COMINE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Comine (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/comine"
        date = "2026-10-16"
    strings:
        $fam_name = "comine" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COMINE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Comine tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/comine"
        date = "2026-10-16"
    strings:
        $attrib_str = "comine" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Comisproc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/comisproc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COMISPROC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Comisproc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/comisproc"
        date = "2026-10-16"
    strings:
        $fam_name = "comisproc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COMISPROC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Comisproc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/comisproc"
        date = "2026-10-16"
    strings:
        $attrib_str = "comisproc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Commandcam (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/commandcam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COMMANDCAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Commandcam (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/commandcam"
        date = "2026-10-16"
    strings:
        $fam_name = "commandcam" ascii wide nocase
        $alias_1 = "hacktool.commandcam" ascii wide nocase
        $alias_2 = "spyware.webcam" ascii wide nocase
        $alias_3 = "tool.camcapture" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COMMANDCAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Commandcam tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/commandcam"
        date = "2026-10-16"
    strings:
        $attrib_str = "commandcam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Comproc (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/comproc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COMPROC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Comproc (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/comproc"
        date = "2026-10-16"
    strings:
        $fam_name = "comproc" ascii wide nocase
        $alias_1 = "rootkit.comproc" ascii wide nocase
        $alias_2 = "trojan.comproc" ascii wide nocase
        $alias_3 = "backdoor.win32.comproc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COMPROC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Comproc tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/comproc"
        date = "2026-10-16"
    strings:
        $attrib_str = "comproc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Computty (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/computty
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COMPUTTY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Computty (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/computty"
        date = "2026-10-16"
    strings:
        $fam_name = "computty" ascii wide nocase
        $alias_1 = "hacktool.putty" ascii wide nocase
        $alias_2 = "trojan.putty.modified" ascii wide nocase
        $alias_3 = "pws.putty" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COMPUTTY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Computty tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/computty"
        date = "2026-10-16"
    strings:
        $attrib_str = "computty" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Comrerop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/comrerop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COMREROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Comrerop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/comrerop"
        date = "2026-10-16"
    strings:
        $fam_name = "comrerop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COMREROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Comrerop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/comrerop"
        date = "2026-10-16"
    strings:
        $attrib_str = "comrerop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Conduit (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/conduit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CONDUIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Conduit (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/conduit"
        date = "2026-10-16"
    strings:
        $fam_name = "conduit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CONDUIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Conduit tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/conduit"
        date = "2026-10-16"
    strings:
        $attrib_str = "conduit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Conficker (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/conficker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CONFICKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Conficker (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/conficker"
        date = "2026-10-16"
    strings:
        $fam_name = "conficker" ascii wide nocase
        $alias_1 = "conficker" ascii wide nocase
        $alias_2 = "downadup" ascii wide nocase
        $alias_3 = "kido" ascii wide nocase
        $alias_4 = "win32/conficker" ascii wide nocase
        $alias_5 = "net-worm.win32.kido" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CONFICKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Conficker tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/conficker"
        date = "2026-10-16"
    strings:
        $attrib_str = "conficker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Confucius (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/confucius
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CONFUCIUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Confucius (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/confucius"
        date = "2026-10-16"
    strings:
        $fam_name = "confucius" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CONFUCIUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Confucius tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/confucius"
        date = "2026-10-16"
    strings:
        $attrib_str = "confucius" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Confuser (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/confuser
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CONFUSER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Confuser (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/confuser"
        date = "2026-10-16"
    strings:
        $fam_name = "confuser" ascii wide nocase
        $alias_1 = "hacktool:msil/confuser" ascii wide nocase
        $alias_2 = "trojan:msil/confuser" ascii wide nocase
        $alias_3 = "virtool:msil/obfuscator" ascii wide nocase
        $alias_4 = "confuserex" ascii wide nocase
        $alias_5 = "malware.obfuscator.confuser" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CONFUSER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Confuser tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/confuser"
        date = "2026-10-16"
    strings:
        $attrib_str = "confuser" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Conjar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/conjar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CONJAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Conjar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/conjar"
        date = "2026-10-16"
    strings:
        $fam_name = "conjar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CONJAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Conjar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/conjar"
        date = "2026-10-16"
    strings:
        $attrib_str = "conjar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Conju (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/conju
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CONJU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Conju (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/conju"
        date = "2026-10-16"
    strings:
        $fam_name = "conju" ascii wide nocase
        $alias_1 = "trojan.conju" ascii wide nocase
        $alias_2 = "downloader.conju" ascii wide nocase
        $alias_3 = "win32/conju" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CONJU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Conju tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/conju"
        date = "2026-10-16"
    strings:
        $attrib_str = "conju" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Convertad (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/convertad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CONVERTAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Convertad (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/convertad"
        date = "2026-10-16"
    strings:
        $fam_name = "convertad" ascii wide nocase
        $alias_1 = "adware:win32/convertad" ascii wide nocase
        $alias_2 = "pua:win32/convertad" ascii wide nocase
        $alias_3 = "win32/convertad" ascii wide nocase
        $alias_4 = "adware.convertad" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CONVERTAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Convertad tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/convertad"
        date = "2026-10-16"
    strings:
        $attrib_str = "convertad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cookiesstealer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cookiesstealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COOKIESSTEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cookiesstealer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cookiesstealer"
        date = "2026-10-16"
    strings:
        $fam_name = "cookiesstealer" ascii wide nocase
        $alias_1 = "trojan.cookiesstealer" ascii wide nocase
        $alias_2 = "spyware.cookiestealer" ascii wide nocase
        $alias_3 = "pws.win32.cookies" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COOKIESSTEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cookiesstealer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cookiesstealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "cookiesstealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cool_Remote_Control (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cool_remote_control
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COOL_REMOTE_CONTROL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cool_Remote_Control (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cool_remote_control"
        date = "2026-10-16"
    strings:
        $fam_name = "cool_remote_control" ascii wide nocase
        $alias_1 = "cool rat" ascii wide nocase
        $alias_2 = "coolremote" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COOL_REMOTE_CONTROL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cool_Remote_Control tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cool_remote_control"
        date = "2026-10-16"
    strings:
        $attrib_str = "cool_remote_control" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Coolmirage (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/coolmirage
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COOLMIRAGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Coolmirage (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coolmirage"
        date = "2026-10-16"
    strings:
        $fam_name = "coolmirage" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COOLMIRAGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Coolmirage tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coolmirage"
        date = "2026-10-16"
    strings:
        $attrib_str = "coolmirage" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Coolvibes (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/coolvibes
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COOLVIBES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Coolvibes (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coolvibes"
        date = "2026-10-16"
    strings:
        $fam_name = "coolvibes" ascii wide nocase
        $alias_1 = "cool vibes rat" ascii wide nocase
        $alias_2 = "win32.coolvibes" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COOLVIBES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Coolvibes tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coolvibes"
        date = "2026-10-16"
    strings:
        $attrib_str = "coolvibes" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Copperturtle (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/copperturtle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COPPERTURTLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Copperturtle (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/copperturtle"
        date = "2026-10-16"
    strings:
        $fam_name = "copperturtle" ascii wide nocase
        $alias_1 = "trojan.copperturtle" ascii wide nocase
        $alias_2 = "backdoor.apt.copperturtle" ascii wide nocase
        $alias_3 = "win32/copperturtle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COPPERTURTLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Copperturtle tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/copperturtle"
        date = "2026-10-16"
    strings:
        $attrib_str = "copperturtle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cordis (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cordis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CORDIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cordis (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cordis"
        date = "2026-10-16"
    strings:
        $fam_name = "cordis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CORDIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cordis tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cordis"
        date = "2026-10-16"
    strings:
        $attrib_str = "cordis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Corebot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/corebot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COREBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Corebot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/corebot"
        date = "2026-10-16"
    strings:
        $fam_name = "corebot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COREBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Corebot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/corebot"
        date = "2026-10-16"
    strings:
        $attrib_str = "corebot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Corpse (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/corpse
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CORPSE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Corpse (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/corpse"
        date = "2026-10-16"
    strings:
        $fam_name = "corpse" ascii wide nocase
        $alias_1 = "trojan.corpse" ascii wide nocase
        $alias_2 = "downloader.corpse" ascii wide nocase
        $alias_3 = "win32/corpse" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CORPSE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Corpse tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/corpse"
        date = "2026-10-16"
    strings:
        $attrib_str = "corpse" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Corrempa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/corrempa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CORREMPA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Corrempa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/corrempa"
        date = "2026-10-16"
    strings:
        $fam_name = "corrempa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CORREMPA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Corrempa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/corrempa"
        date = "2026-10-16"
    strings:
        $attrib_str = "corrempa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cosmicduke (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cosmicduke
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COSMICDUKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cosmicduke (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cosmicduke"
        date = "2026-10-16"
    strings:
        $fam_name = "cosmicduke" ascii wide nocase
        $alias_1 = "cosmicduke" ascii wide nocase
        $alias_2 = "bot-moog" ascii wide nocase
        $alias_3 = "tinybaron" ascii wide nocase
        $alias_4 = "nemor" ascii wide nocase
        $alias_5 = "backdoor:win32/cosmicduke" ascii wide nocase
        $alias_6 = "trojan.cosmicduke" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COSMICDUKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cosmicduke tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cosmicduke"
        date = "2026-10-16"
    strings:
        $attrib_str = "cosmicduke" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cosmu (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cosmu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COSMU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cosmu (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cosmu"
        date = "2026-10-16"
    strings:
        $fam_name = "cosmu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COSMU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cosmu tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cosmu"
        date = "2026-10-16"
    strings:
        $attrib_str = "cosmu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Cosratu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cosratu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COSRATU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cosratu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cosratu"
        date = "2026-10-16"
    strings:
        $fam_name = "cosratu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COSRATU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cosratu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cosratu"
        date = "2026-10-16"
    strings:
        $attrib_str = "cosratu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cossta (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cossta
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COSSTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cossta (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cossta"
        date = "2026-10-16"
    strings:
        $fam_name = "cossta" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COSSTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cossta tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cossta"
        date = "2026-10-16"
    strings:
        $attrib_str = "cossta" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Couponmarvel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/couponmarvel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COUPONMARVEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Couponmarvel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/couponmarvel"
        date = "2026-10-16"
    strings:
        $fam_name = "couponmarvel" ascii wide nocase
        $alias_1 = "adware.couponmarvel" ascii wide nocase
        $alias_2 = "pup.couponmarvel" ascii wide nocase
        $alias_3 = "win32/adware.couponmarvel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COUPONMARVEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Couponmarvel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/couponmarvel"
        date = "2026-10-16"
    strings:
        $attrib_str = "couponmarvel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Coupons (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/coupons
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COUPONS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Coupons (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coupons"
        date = "2026-10-16"
    strings:
        $fam_name = "coupons" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COUPONS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Coupons tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/coupons"
        date = "2026-10-16"
    strings:
        $attrib_str = "coupons" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Covus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/covus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_COVUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Covus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/covus"
        date = "2026-10-16"
    strings:
        $fam_name = "covus" ascii wide nocase
        $alias_1 = "trojan.covus" ascii wide nocase
        $alias_2 = "downloader.covus" ascii wide nocase
        $alias_3 = "win32/covus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_COVUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Covus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/covus"
        date = "2026-10-16"
    strings:
        $attrib_str = "covus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cpuminer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cpuminer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CPUMINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cpuminer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cpuminer"
        date = "2026-10-16"
    strings:
        $fam_name = "cpuminer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CPUMINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cpuminer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cpuminer"
        date = "2026-10-16"
    strings:
        $attrib_str = "cpuminer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cqst (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cqst
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CQST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cqst (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cqst"
        date = "2026-10-16"
    strings:
        $fam_name = "cqst" ascii wide nocase
        $alias_1 = "trojan.cqst" ascii wide nocase
        $alias_2 = "downloader.cqst" ascii wide nocase
        $alias_3 = "win32/cqst" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CQST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cqst tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cqst"
        date = "2026-10-16"
    strings:
        $attrib_str = "cqst" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crastic (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crastic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRASTIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crastic (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crastic"
        date = "2026-10-16"
    strings:
        $fam_name = "crastic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRASTIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crastic tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crastic"
        date = "2026-10-16"
    strings:
        $attrib_str = "crastic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crawler (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crawler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRAWLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crawler (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crawler"
        date = "2026-10-16"
    strings:
        $fam_name = "crawler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRAWLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crawler tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crawler"
        date = "2026-10-16"
    strings:
        $attrib_str = "crawler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Crcf (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crcf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRCF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crcf (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crcf"
        date = "2026-10-16"
    strings:
        $fam_name = "crcf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRCF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crcf tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crcf"
        date = "2026-10-16"
    strings:
        $attrib_str = "crcf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Creprote (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/creprote
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CREPROTE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Creprote (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/creprote"
        date = "2026-10-16"
    strings:
        $fam_name = "creprote" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CREPROTE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Creprote tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/creprote"
        date = "2026-10-16"
    strings:
        $attrib_str = "creprote" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cridex (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cridex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRIDEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cridex (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cridex"
        date = "2026-10-16"
    strings:
        $fam_name = "cridex" ascii wide nocase
        $alias_1 = "worm.cridex" ascii wide nocase
        $alias_2 = "trojan.cridex" ascii wide nocase
        $alias_3 = "w32/cridex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRIDEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cridex tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cridex"
        date = "2026-10-16"
    strings:
        $attrib_str = "cridex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Crifi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crifi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRIFI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crifi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crifi"
        date = "2026-10-16"
    strings:
        $fam_name = "crifi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRIFI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crifi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crifi"
        date = "2026-10-16"
    strings:
        $attrib_str = "crifi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crime (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crime
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRIME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crime (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crime"
        date = "2026-10-16"
    strings:
        $fam_name = "crime" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRIME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crime tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crime"
        date = "2026-10-16"
    strings:
        $attrib_str = "crime" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crisisht (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crisisht
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRISISHT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crisisht (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crisisht"
        date = "2026-10-16"
    strings:
        $fam_name = "crisisht" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRISISHT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crisisht tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crisisht"
        date = "2026-10-16"
    strings:
        $attrib_str = "crisisht" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crispit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crispit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRISPIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crispit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crispit"
        date = "2026-10-16"
    strings:
        $fam_name = "crispit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRISPIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crispit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crispit"
        date = "2026-10-16"
    strings:
        $attrib_str = "crispit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cromptui (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cromptui
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CROMPTUI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cromptui (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cromptui"
        date = "2026-10-16"
    strings:
        $fam_name = "cromptui" ascii wide nocase
        $alias_1 = "trojan.cromptui" ascii wide nocase
        $alias_2 = "downloader.cromptui" ascii wide nocase
        $alias_3 = "win32/cromptui" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CROMPTUI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cromptui tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cromptui"
        date = "2026-10-16"
    strings:
        $attrib_str = "cromptui" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crossrider (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crossrider
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CROSSRIDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crossrider (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crossrider"
        date = "2026-10-16"
    strings:
        $fam_name = "crossrider" ascii wide nocase
        $alias_1 = "adware:win32/crossrider" ascii wide nocase
        $alias_2 = "pua:win32/crossrider" ascii wide nocase
        $alias_3 = "adware.crossrider" ascii wide nocase
        $alias_4 = "win32/crossrider" ascii wide nocase
        $alias_5 = "osx/crossrider" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CROSSRIDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crossrider tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crossrider"
        date = "2026-10-16"
    strings:
        $attrib_str = "crossrider" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Crowti (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crowti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CROWTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crowti (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crowti"
        date = "2026-10-16"
    strings:
        $fam_name = "crowti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CROWTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crowti tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crowti"
        date = "2026-10-16"
    strings:
        $attrib_str = "crowti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crusis (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crusis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRUSIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crusis (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crusis"
        date = "2026-10-16"
    strings:
        $fam_name = "crusis" ascii wide nocase
        $alias_1 = "ransom:win32/crusis" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.crusis" ascii wide nocase
        $alias_3 = "crysis" ascii wide nocase
        $alias_4 = "dharma" ascii wide nocase
        $alias_5 = "ransom:win32/crusis.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRUSIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crusis tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crusis"
        date = "2026-10-16"
    strings:
        $attrib_str = "crusis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryakl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryakl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYAKL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryakl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryakl"
        date = "2026-10-16"
    strings:
        $fam_name = "cryakl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYAKL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryakl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryakl"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryakl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryfile (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryfile
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYFILE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryfile (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryfile"
        date = "2026-10-16"
    strings:
        $fam_name = "cryfile" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYFILE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryfile tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryfile"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryfile" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crypmod (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crypmod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPMOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crypmod (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crypmod"
        date = "2026-10-16"
    strings:
        $fam_name = "crypmod" ascii wide nocase
        $alias_1 = "ransom:win32/crypmod" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.crypmod" ascii wide nocase
        $alias_3 = "trojan.crypmod" ascii wide nocase
        $alias_4 = "win32/crypmod" ascii wide nocase
        $alias_5 = "ransom:win32/crypmod.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPMOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crypmod tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crypmod"
        date = "2026-10-16"
    strings:
        $attrib_str = "crypmod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crypmodadv (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crypmodadv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPMODADV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crypmodadv (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crypmodadv"
        date = "2026-10-16"
    strings:
        $fam_name = "crypmodadv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPMODADV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crypmodadv tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crypmodadv"
        date = "2026-10-16"
    strings:
        $attrib_str = "crypmodadv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crypren (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crypren
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPREN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crypren (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crypren"
        date = "2026-10-16"
    strings:
        $fam_name = "crypren" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPREN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crypren tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crypren"
        date = "2026-10-16"
    strings:
        $attrib_str = "crypren" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crypt0L0Cker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crypt0l0cker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPT0L0CKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crypt0L0Cker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crypt0l0cker"
        date = "2026-10-16"
    strings:
        $fam_name = "crypt0l0cker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPT0L0CKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crypt0L0Cker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crypt0l0cker"
        date = "2026-10-16"
    strings:
        $attrib_str = "crypt0l0cker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptconsole (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptconsole
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTCONSOLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptconsole (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptconsole"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptconsole" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTCONSOLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptconsole tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptconsole"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptconsole" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptear (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptear
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTEAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptear (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptear"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptear" ascii wide nocase
        $alias_1 = "ransomware.cryptear" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.cryptear" ascii wide nocase
        $alias_3 = "cryptolocker.cryptear" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTEAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptear tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptear"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptear" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptexe (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptexe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTEXE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptexe (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptexe"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptexe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTEXE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptexe tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptexe"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptexe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptinject (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptinject
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTINJECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptinject (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptinject"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptinject" ascii wide nocase
        $alias_1 = "ransom:win32/cryptinject" ascii wide nocase
        $alias_2 = "trojan:win32/cryptinject" ascii wide nocase
        $alias_3 = "virtool:win32/cryptinject" ascii wide nocase
        $alias_4 = "win32/cryptinject" ascii wide nocase
        $alias_5 = "cryptinject ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTINJECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptinject tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptinject"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptinject" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptojoker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptojoker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTOJOKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptojoker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptojoker"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptojoker" ascii wide nocase
        $alias_1 = "ransom.cryptojoker" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.cryptojoker" ascii wide nocase
        $alias_3 = "win32/filecoder.cryptojoker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTOJOKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptojoker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptojoker"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptojoker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptoload (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptoload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTOLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptoload (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptoload"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptoload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTOLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptoload tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptoload"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptoload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptolocker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptolocker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTOLOCKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptolocker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptolocker"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptolocker" ascii wide nocase
        $alias_1 = "cryptolocker" ascii wide nocase
        $alias_2 = "trojan.cryptolocker" ascii wide nocase
        $alias_3 = "win32/cryptolocker" ascii wide nocase
        $alias_4 = "ransom.cryptolocker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTOLOCKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptolocker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptolocker"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptolocker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptominer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptominer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTOMINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptominer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptominer"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptominer" ascii wide nocase
        $alias_1 = "riskware.coinminer" ascii wide nocase
        $alias_2 = "trojan.miner" ascii wide nocase
        $alias_3 = "pua.miner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTOMINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptominer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptominer"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptominer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Cryptomix (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptomix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTOMIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptomix (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptomix"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptomix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTOMIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptomix tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptomix"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptomix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crypton (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crypton
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crypton (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crypton"
        date = "2026-10-16"
    strings:
        $fam_name = "crypton" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crypton tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crypton"
        date = "2026-10-16"
    strings:
        $attrib_str = "crypton" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptos (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptos (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptos"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptos tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptos"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptowall (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptowall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTOWALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptowall (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptowall"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptowall" ascii wide nocase
        $alias_1 = "cryptodefense" ascii wide nocase
        $alias_2 = "cryptowall3" ascii wide nocase
        $alias_3 = "cryptowall4" ascii wide nocase
        $alias_4 = "win32.cryptowall" ascii wide nocase
        $alias_5 = "crowti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTOWALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptowall tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptowall"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptowall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptowire (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptowire
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTOWIRE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptowire (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptowire"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptowire" ascii wide nocase
        $alias_1 = "ransomware.cryptowire" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.cryptowire" ascii wide nocase
        $alias_3 = "cryptolocker.wire" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTOWIRE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptowire tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptowire"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptowire" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptpack (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptpack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTPACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptpack (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptpack"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptpack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTPACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptpack tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptpack"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptpack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptredol (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptredol
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTREDOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptredol (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptredol"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptredol" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTREDOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptredol tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptredol"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptredol" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryptxxx (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryptxxx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYPTXXX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryptxxx (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptxxx"
        date = "2026-10-16"
    strings:
        $fam_name = "cryptxxx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYPTXXX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryptxxx tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryptxxx"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryptxxx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cryrar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cryrar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYRAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cryrar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryrar"
        date = "2026-10-16"
    strings:
        $fam_name = "cryrar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYRAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cryrar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cryrar"
        date = "2026-10-16"
    strings:
        $attrib_str = "cryrar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crysis (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crysis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYSIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crysis (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crysis"
        date = "2026-10-16"
    strings:
        $fam_name = "crysis" ascii wide nocase
        $alias_1 = "crysis" ascii wide nocase
        $alias_2 = "dharma" ascii wide nocase
        $alias_3 = "ransom.crysis" ascii wide nocase
        $alias_4 = "trojan-ransom.win32.crusis" ascii wide nocase
        $alias_5 = "w32/crysis" ascii wide nocase
        $alias_6 = "ransom.dharma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYSIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crysis tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crysis"
        date = "2026-10-16"
    strings:
        $attrib_str = "crysis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Crytex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/crytex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CRYTEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crytex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crytex"
        date = "2026-10-16"
    strings:
        $fam_name = "crytex" ascii wide nocase
        $alias_1 = "ransom:win32/crytex" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.crysis" ascii wide nocase
        $alias_3 = "ransom.crysis" ascii wide nocase
        $alias_4 = "crytex ransomware" ascii wide nocase
        $alias_5 = "win32/crytex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CRYTEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crytex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/crytex"
        date = "2026-10-16"
    strings:
        $attrib_str = "crytex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Csdimonetize (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/csdimonetize
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CSDIMONETIZE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Csdimonetize (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/csdimonetize"
        date = "2026-10-16"
    strings:
        $fam_name = "csdimonetize" ascii wide nocase
        $alias_1 = "adware:win32/csdimonetize" ascii wide nocase
        $alias_2 = "adware.csdimonetize" ascii wide nocase
        $alias_3 = "pua:win32/csdimonetize" ascii wide nocase
        $alias_4 = "trojan:win32/csdimonetize" ascii wide nocase
        $alias_5 = "win32/csdimonetize" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CSDIMONETIZE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Csdimonetize tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/csdimonetize"
        date = "2026-10-16"
    strings:
        $attrib_str = "csdimonetize" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cshv (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cshv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CSHV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cshv (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cshv"
        date = "2026-10-16"
    strings:
        $fam_name = "cshv" ascii wide nocase
        $alias_1 = "trojan.cshv" ascii wide nocase
        $alias_2 = "downloader.cshv" ascii wide nocase
        $alias_3 = "win32/cshv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CSHV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cshv tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cshv"
        date = "2026-10-16"
    strings:
        $attrib_str = "cshv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cslz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cslz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CSLZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cslz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cslz"
        date = "2026-10-16"
    strings:
        $fam_name = "cslz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CSLZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cslz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cslz"
        date = "2026-10-16"
    strings:
        $attrib_str = "cslz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Csom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/csom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CSOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Csom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/csom"
        date = "2026-10-16"
    strings:
        $fam_name = "csom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CSOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Csom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/csom"
        date = "2026-10-16"
    strings:
        $attrib_str = "csom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Csrb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/csrb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CSRB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Csrb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/csrb"
        date = "2026-10-16"
    strings:
        $fam_name = "csrb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CSRB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Csrb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/csrb"
        date = "2026-10-16"
    strings:
        $attrib_str = "csrb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ctqc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ctqc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CTQC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ctqc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ctqc"
        date = "2026-10-16"
    strings:
        $fam_name = "ctqc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CTQC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ctqc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ctqc"
        date = "2026-10-16"
    strings:
        $attrib_str = "ctqc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cuegoe (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cuegoe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CUEGOE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cuegoe (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cuegoe"
        date = "2026-10-16"
    strings:
        $fam_name = "cuegoe" ascii wide nocase
        $alias_1 = "trojan:win32/cuegoe" ascii wide nocase
        $alias_2 = "cuegoe" ascii wide nocase
        $alias_3 = "backdoor.win32.cuegoe" ascii wide nocase
        $alias_4 = "win32/cuegoe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CUEGOE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cuegoe tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cuegoe"
        date = "2026-10-16"
    strings:
        $attrib_str = "cuegoe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cussteel (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cussteel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CUSSTEEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cussteel (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cussteel"
        date = "2026-10-16"
    strings:
        $fam_name = "cussteel" ascii wide nocase
        $alias_1 = "trojan.pws.cussteel" ascii wide nocase
        $alias_2 = "spyware.cussteel" ascii wide nocase
        $alias_3 = "win32/cussteel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CUSSTEEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cussteel tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cussteel"
        date = "2026-10-16"
    strings:
        $attrib_str = "cussteel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cutwail (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cutwail
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CUTWAIL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cutwail (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cutwail"
        date = "2026-10-16"
    strings:
        $fam_name = "cutwail" ascii wide nocase
        $alias_1 = "cutwail" ascii wide nocase
        $alias_2 = "pushdo" ascii wide nocase
        $alias_3 = "pandex" ascii wide nocase
        $alias_4 = "win32/cutwail" ascii wide nocase
        $alias_5 = "trojan.pushdo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CUTWAIL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cutwail tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cutwail"
        date = "2026-10-16"
    strings:
        $attrib_str = "cutwail" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cvky (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cvky
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CVKY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cvky (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cvky"
        date = "2026-10-16"
    strings:
        $fam_name = "cvky" ascii wide nocase
        $alias_1 = "trojan.cvky" ascii wide nocase
        $alias_2 = "downloader.cvky" ascii wide nocase
        $alias_3 = "win32/cvky" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CVKY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cvky tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cvky"
        date = "2026-10-16"
    strings:
        $attrib_str = "cvky" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cwqw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cwqw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CWQW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cwqw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cwqw"
        date = "2026-10-16"
    strings:
        $fam_name = "cwqw" ascii wide nocase
        $alias_1 = "ransom:win32/cwqw" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.cwqw" ascii wide nocase
        $alias_3 = "win32/cwqw" ascii wide nocase
        $alias_4 = "cwqw ransomware" ascii wide nocase
        $alias_5 = "ransom.cwqw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CWQW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cwqw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cwqw"
        date = "2026-10-16"
    strings:
        $attrib_str = "cwqw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cxkh (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cxkh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CXKH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cxkh (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cxkh"
        date = "2026-10-16"
    strings:
        $fam_name = "cxkh" ascii wide nocase
        $alias_1 = "trojan.cxkh" ascii wide nocase
        $alias_2 = "downloader.cxkh" ascii wide nocase
        $alias_3 = "win32/cxkh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CXKH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cxkh tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cxkh"
        date = "2026-10-16"
    strings:
        $attrib_str = "cxkh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cxkj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cxkj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CXKJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cxkj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cxkj"
        date = "2026-10-16"
    strings:
        $fam_name = "cxkj" ascii wide nocase
        $alias_1 = "trojan.cxkj" ascii wide nocase
        $alias_2 = "downloader.cxkj" ascii wide nocase
        $alias_3 = "win32/cxkj" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CXKJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cxkj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cxkj"
        date = "2026-10-16"
    strings:
        $attrib_str = "cxkj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cybergate (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cybergate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CYBERGATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cybergate (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cybergate"
        date = "2026-10-16"
    strings:
        $fam_name = "cybergate" ascii wide nocase
        $alias_1 = "cybergate" ascii wide nocase
        $alias_2 = "cybergate rat" ascii wide nocase
        $alias_3 = "trojan:win32/cybergate" ascii wide nocase
        $alias_4 = "backdoor.cybergate" ascii wide nocase
        $alias_5 = "win32/cybergate" ascii wide nocase
        $alias_6 = "trojan.cybergate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CYBERGATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cybergate tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cybergate"
        date = "2026-10-16"
    strings:
        $attrib_str = "cybergate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Cybernetic (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cybernetic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CYBERNETIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cybernetic (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cybernetic"
        date = "2026-10-16"
    strings:
        $fam_name = "cybernetic" ascii wide nocase
        $alias_1 = "irc.cybernetic" ascii wide nocase
        $alias_2 = "cybernetic bot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CYBERNETIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cybernetic tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cybernetic"
        date = "2026-10-16"
    strings:
        $attrib_str = "cybernetic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cycbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cycbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CYCBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cycbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cycbot"
        date = "2026-10-16"
    strings:
        $fam_name = "cycbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CYCBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cycbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cycbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "cycbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cyfin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cyfin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CYFIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cyfin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cyfin"
        date = "2026-10-16"
    strings:
        $fam_name = "cyfin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CYFIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cyfin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cyfin"
        date = "2026-10-16"
    strings:
        $attrib_str = "cyfin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Cyn (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cyn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CYN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cyn (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cyn"
        date = "2026-10-16"
    strings:
        $fam_name = "cyn" ascii wide nocase
        $alias_1 = "dos.cyn" ascii wide nocase
        $alias_2 = "virus.dos.cyn.446" ascii wide nocase
        $alias_3 = "virus:win32/cyn" ascii wide nocase
        $alias_4 = "cyn.446" ascii wide nocase
        $alias_5 = "cyn.512" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CYN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cyn tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cyn"
        date = "2026-10-16"
    strings:
        $attrib_str = "cyn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Cypress (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/cypress
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CYPRESS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Cypress (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cypress"
        date = "2026-10-16"
    strings:
        $fam_name = "cypress" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CYPRESS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cypress tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/cypress"
        date = "2026-10-16"
    strings:
        $attrib_str = "cypress" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Czyk (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/czyk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CZYK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Czyk (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/czyk"
        date = "2026-10-16"
    strings:
        $fam_name = "czyk" ascii wide nocase
        $alias_1 = "trojan:win32/czyk" ascii wide nocase
        $alias_2 = "ransom:win32/czyk" ascii wide nocase
        $alias_3 = "trojan.czyk" ascii wide nocase
        $alias_4 = "win32/czyk" ascii wide nocase
        $alias_5 = "trojan:win32/czyk.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CZYK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Czyk tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/czyk"
        date = "2026-10-16"
    strings:
        $attrib_str = "czyk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for D0F3570C (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/d0f3570c
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_D0F3570C_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for D0F3570C (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/d0f3570c"
        date = "2026-10-16"
    strings:
        $fam_name = "d0f3570c" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_D0F3570C_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for D0F3570C tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/d0f3570c"
        date = "2026-10-16"
    strings:
        $attrib_str = "d0f3570c" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dacic (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dacic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DACIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dacic (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dacic"
        date = "2026-10-16"
    strings:
        $fam_name = "dacic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DACIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dacic tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dacic"
        date = "2026-10-16"
    strings:
        $attrib_str = "dacic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dadobra (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dadobra
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DADOBRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dadobra (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dadobra"
        date = "2026-10-16"
    strings:
        $fam_name = "dadobra" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DADOBRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dadobra tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dadobra"
        date = "2026-10-16"
    strings:
        $attrib_str = "dadobra" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dalatar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dalatar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DALATAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dalatar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dalatar"
        date = "2026-10-16"
    strings:
        $fam_name = "dalatar" ascii wide nocase
        $alias_1 = "trojan.dalatar" ascii wide nocase
        $alias_2 = "downloader.dalatar" ascii wide nocase
        $alias_3 = "win32/dalatar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DALATAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dalatar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dalatar"
        date = "2026-10-16"
    strings:
        $attrib_str = "dalatar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dalbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dalbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DALBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dalbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dalbot"
        date = "2026-10-16"
    strings:
        $fam_name = "dalbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DALBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dalbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dalbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "dalbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dalexis (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dalexis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DALEXIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dalexis (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dalexis"
        date = "2026-10-16"
    strings:
        $fam_name = "dalexis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DALEXIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dalexis tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dalexis"
        date = "2026-10-16"
    strings:
        $attrib_str = "dalexis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dalt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dalt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DALT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dalt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dalt"
        date = "2026-10-16"
    strings:
        $fam_name = "dalt" ascii wide nocase
        $alias_1 = "trojan.dalt" ascii wide nocase
        $alias_2 = "downloader.dalt" ascii wide nocase
        $alias_3 = "win32/dalt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DALT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dalt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dalt"
        date = "2026-10-16"
    strings:
        $attrib_str = "dalt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Danabot (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/danabot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DANABOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Danabot (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/danabot"
        date = "2026-10-16"
    strings:
        $fam_name = "danabot" ascii wide nocase
        $alias_1 = "danabot" ascii wide nocase
        $alias_2 = "trojan.danabot" ascii wide nocase
        $alias_3 = "win32/danabot" ascii wide nocase
        $alias_4 = "backdoor.danabot" ascii wide nocase
        $alias_5 = "delphi.danabot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DANABOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Danabot tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/danabot"
        date = "2026-10-16"
    strings:
        $attrib_str = "danabot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dapato (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dapato
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DAPATO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dapato (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dapato"
        date = "2026-10-16"
    strings:
        $fam_name = "dapato" ascii wide nocase
        $alias_1 = "trojan:win32/dapato" ascii wide nocase
        $alias_2 = "trojan-dropper.win32.dapato" ascii wide nocase
        $alias_3 = "trojandownloader:win32/dapato" ascii wide nocase
        $alias_4 = "win32/dapato" ascii wide nocase
        $alias_5 = "trojan.dapato" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DAPATO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dapato tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dapato"
        date = "2026-10-16"
    strings:
        $attrib_str = "dapato" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Darkcyrene (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/darkcyrene
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DARKCYRENE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Darkcyrene (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkcyrene"
        date = "2026-10-16"
    strings:
        $fam_name = "darkcyrene" ascii wide nocase
        $alias_1 = "trojan.darkcyrene" ascii wide nocase
        $alias_2 = "downloader.darkcyrene" ascii wide nocase
        $alias_3 = "win32/darkcyrene" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DARKCYRENE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Darkcyrene tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkcyrene"
        date = "2026-10-16"
    strings:
        $attrib_str = "darkcyrene" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Darkgate (Loader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/darkgate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DARKGATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Darkgate (Loader)"
        category = "Loader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkgate"
        date = "2026-10-16"
    strings:
        $fam_name = "darkgate" ascii wide nocase
        $alias_1 = "darkgate" ascii wide nocase
        $alias_2 = "meh_crypter" ascii wide nocase
        $alias_3 = "dark_gate" ascii wide nocase
        $alias_4 = "win32/darkgate" ascii wide nocase
        $alias_5 = "darkgate rat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DARKGATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Darkgate tradecraft"
        category = "Loader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkgate"
        date = "2026-10-16"
    strings:
        $attrib_str = "darkgate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Darkhotel (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/darkhotel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DARKHOTEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Darkhotel (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkhotel"
        date = "2026-10-16"
    strings:
        $fam_name = "darkhotel" ascii wide nocase
        $alias_1 = "darkhotel" ascii wide nocase
        $alias_2 = "apt.darkhotel" ascii wide nocase
        $alias_3 = "trojan.darkhotel" ascii wide nocase
        $alias_4 = "tapaoux" ascii wide nocase
        $alias_5 = "fallout" ascii wide nocase
        $alias_6 = "karba" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DARKHOTEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Darkhotel tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkhotel"
        date = "2026-10-16"
    strings:
        $attrib_str = "darkhotel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Darkkomet (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/darkkomet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DARKKOMET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Darkkomet (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkkomet"
        date = "2026-10-16"
    strings:
        $fam_name = "darkkomet" ascii wide nocase
        $alias_1 = "darkcomet" ascii wide nocase
        $alias_2 = "darkcomet rat" ascii wide nocase
        $alias_3 = "darkkomet" ascii wide nocase
        $alias_4 = "trojan.darkcomet" ascii wide nocase
        $alias_5 = "backdoor.win32.darkkomet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DARKKOMET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Darkkomet tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkkomet"
        date = "2026-10-16"
    strings:
        $attrib_str = "darkkomet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Darkmoon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/darkmoon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DARKMOON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Darkmoon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkmoon"
        date = "2026-10-16"
    strings:
        $fam_name = "darkmoon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DARKMOON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Darkmoon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkmoon"
        date = "2026-10-16"
    strings:
        $attrib_str = "darkmoon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Darkneuron (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/darkneuron
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DARKNEURON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Darkneuron (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkneuron"
        date = "2026-10-16"
    strings:
        $fam_name = "darkneuron" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DARKNEURON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Darkneuron tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkneuron"
        date = "2026-10-16"
    strings:
        $attrib_str = "darkneuron" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Darkvnc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/darkvnc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DARKVNC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Darkvnc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkvnc"
        date = "2026-10-16"
    strings:
        $fam_name = "darkvnc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DARKVNC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Darkvnc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkvnc"
        date = "2026-10-16"
    strings:
        $attrib_str = "darkvnc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Darsing (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/darsing
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DARSING_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Darsing (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darsing"
        date = "2026-10-16"
    strings:
        $fam_name = "darsing" ascii wide nocase
        $alias_1 = "trojan.darsing" ascii wide nocase
        $alias_2 = "downloader.darsing" ascii wide nocase
        $alias_3 = "win32/darsing" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DARSING_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Darsing tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darsing"
        date = "2026-10-16"
    strings:
        $attrib_str = "darsing" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Datakeeper (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/datakeeper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DATAKEEPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Datakeeper (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/datakeeper"
        date = "2026-10-16"
    strings:
        $fam_name = "datakeeper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DATAKEEPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Datakeeper tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/datakeeper"
        date = "2026-10-16"
    strings:
        $attrib_str = "datakeeper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Datper (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/datper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DATPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Datper (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/datper"
        date = "2026-10-16"
    strings:
        $fam_name = "datper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DATPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Datper tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/datper"
        date = "2026-10-16"
    strings:
        $attrib_str = "datper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Datpol (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/datpol
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DATPOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Datpol (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/datpol"
        date = "2026-10-16"
    strings:
        $fam_name = "datpol" ascii wide nocase
        $alias_1 = "trojan.datpol" ascii wide nocase
        $alias_2 = "downloader.datpol" ascii wide nocase
        $alias_3 = "win32/datpol" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DATPOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Datpol tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/datpol"
        date = "2026-10-16"
    strings:
        $attrib_str = "datpol" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Daum (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/daum
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DAUM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Daum (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/daum"
        date = "2026-10-16"
    strings:
        $fam_name = "daum" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DAUM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Daum tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/daum"
        date = "2026-10-16"
    strings:
        $attrib_str = "daum" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Davobevix (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/davobevix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DAVOBEVIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Davobevix (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/davobevix"
        date = "2026-10-16"
    strings:
        $fam_name = "davobevix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DAVOBEVIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Davobevix tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/davobevix"
        date = "2026-10-16"
    strings:
        $attrib_str = "davobevix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Davy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/davy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DAVY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Davy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/davy"
        date = "2026-10-16"
    strings:
        $fam_name = "davy" ascii wide nocase
        $alias_1 = "trojan.davy" ascii wide nocase
        $alias_2 = "downloader.davy" ascii wide nocase
        $alias_3 = "win32/davy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DAVY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Davy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/davy"
        date = "2026-10-16"
    strings:
        $attrib_str = "davy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Daws (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/daws
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DAWS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Daws (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/daws"
        date = "2026-10-16"
    strings:
        $fam_name = "daws" ascii wide nocase
        $alias_1 = "daws" ascii wide nocase
        $alias_2 = "trojandownloader:win32/daws" ascii wide nocase
        $alias_3 = "trojan.daws" ascii wide nocase
        $alias_4 = "win32/daws" ascii wide nocase
        $alias_5 = "daws downloader" ascii wide nocase
        $alias_6 = "ransom.daws" ascii wide nocase
        $alias_7 = "trojan:win32/daws" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DAWS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Daws tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/daws"
        date = "2026-10-16"
    strings:
        $attrib_str = "daws" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dazi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dazi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DAZI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dazi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dazi"
        date = "2026-10-16"
    strings:
        $fam_name = "dazi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DAZI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dazi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dazi"
        date = "2026-10-16"
    strings:
        $attrib_str = "dazi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dealply (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dealply
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEALPLY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dealply (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dealply"
        date = "2026-10-16"
    strings:
        $fam_name = "dealply" ascii wide nocase
        $alias_1 = "adware:win32/dealply" ascii wide nocase
        $alias_2 = "adware.dealply" ascii wide nocase
        $alias_3 = "win32:dealply" ascii wide nocase
        $alias_4 = "dealply adware" ascii wide nocase
        $alias_5 = "pup.optional.dealply" ascii wide nocase
        $alias_6 = "win32/dealply.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEALPLY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dealply tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dealply"
        date = "2026-10-16"
    strings:
        $attrib_str = "dealply" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Deau (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/deau
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEAU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Deau (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deau"
        date = "2026-10-16"
    strings:
        $fam_name = "deau" ascii wide nocase
        $alias_1 = "trojan.deau" ascii wide nocase
        $alias_2 = "downloader.deau" ascii wide nocase
        $alias_3 = "win32/deau" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEAU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Deau tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deau"
        date = "2026-10-16"
    strings:
        $attrib_str = "deau" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Deceptor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/deceptor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DECEPTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Deceptor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deceptor"
        date = "2026-10-16"
    strings:
        $fam_name = "deceptor" ascii wide nocase
        $alias_1 = "rogue.deceptor" ascii wide nocase
        $alias_2 = "pup.fakeav" ascii wide nocase
        $alias_3 = "scareware.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DECEPTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Deceptor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deceptor"
        date = "2026-10-16"
    strings:
        $attrib_str = "deceptor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Deceptpcclean (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/deceptpcclean
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DECEPTPCCLEAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Deceptpcclean (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deceptpcclean"
        date = "2026-10-16"
    strings:
        $fam_name = "deceptpcclean" ascii wide nocase
        $alias_1 = "pua:win32/deceptpcclean" ascii wide nocase
        $alias_2 = "rogue:win32/deceptpcclean" ascii wide nocase
        $alias_3 = "program:win32/deceptpcclean" ascii wide nocase
        $alias_4 = "win32/deceptpcclean" ascii wide nocase
        $alias_5 = "pup.optional.deceptpcclean" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DECEPTPCCLEAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Deceptpcclean tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deceptpcclean"
        date = "2026-10-16"
    strings:
        $attrib_str = "deceptpcclean" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Deepscan (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/deepscan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEEPSCAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Deepscan (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deepscan"
        date = "2026-10-16"
    strings:
        $fam_name = "deepscan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEEPSCAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Deepscan tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deepscan"
        date = "2026-10-16"
    strings:
        $attrib_str = "deepscan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Deepsea (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/deepsea
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEEPSEA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Deepsea (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deepsea"
        date = "2026-10-16"
    strings:
        $fam_name = "deepsea" ascii wide nocase
        $alias_1 = "adware.deepsea" ascii wide nocase
        $alias_2 = "pup.deepsea" ascii wide nocase
        $alias_3 = "deepsea adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEEPSEA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Deepsea tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deepsea"
        date = "2026-10-16"
    strings:
        $attrib_str = "deepsea" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Defaulttab (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/defaulttab
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEFAULTTAB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Defaulttab (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/defaulttab"
        date = "2026-10-16"
    strings:
        $fam_name = "defaulttab" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEFAULTTAB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Defaulttab tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/defaulttab"
        date = "2026-10-16"
    strings:
        $attrib_str = "defaulttab" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Defmid (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/defmid
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEFMID_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Defmid (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/defmid"
        date = "2026-10-16"
    strings:
        $fam_name = "defmid" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEFMID_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Defmid tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/defmid"
        date = "2026-10-16"
    strings:
        $attrib_str = "defmid" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Defsel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/defsel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEFSEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Defsel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/defsel"
        date = "2026-10-16"
    strings:
        $fam_name = "defsel" ascii wide nocase
        $alias_1 = "trojan.defsel" ascii wide nocase
        $alias_2 = "downloader.defsel" ascii wide nocase
        $alias_3 = "win32/defsel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEFSEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Defsel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/defsel"
        date = "2026-10-16"
    strings:
        $attrib_str = "defsel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Delbar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/delbar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Delbar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delbar"
        date = "2026-10-16"
    strings:
        $fam_name = "delbar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Delbar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delbar"
        date = "2026-10-16"
    strings:
        $attrib_str = "delbar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Deleter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/deleter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELETER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Deleter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deleter"
        date = "2026-10-16"
    strings:
        $fam_name = "deleter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELETER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Deleter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deleter"
        date = "2026-10-16"
    strings:
        $attrib_str = "deleter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Delf (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/delf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Delf (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delf"
        date = "2026-10-16"
    strings:
        $fam_name = "delf" ascii wide nocase
        $alias_1 = "delf" ascii wide nocase
        $alias_2 = "trojan:win32/delf" ascii wide nocase
        $alias_3 = "trojanspy:win32/delf" ascii wide nocase
        $alias_4 = "trojan.win32.delf" ascii wide nocase
        $alias_5 = "win32/delf" ascii wide nocase
        $alias_6 = "malware.delphi" ascii wide nocase
        $alias_7 = "delf trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Delf tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delf"
        date = "2026-10-16"
    strings:
        $attrib_str = "delf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Delfidelfi (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/delfidelfi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELFIDELFI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Delfidelfi (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delfidelfi"
        date = "2026-10-16"
    strings:
        $fam_name = "delfidelfi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELFIDELFI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Delfidelfi tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delfidelfi"
        date = "2026-10-16"
    strings:
        $attrib_str = "delfidelfi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Delfile (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/delfile
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELFILE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Delfile (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delfile"
        date = "2026-10-16"
    strings:
        $fam_name = "delfile" ascii wide nocase
        $alias_1 = "trojan.delfile" ascii wide nocase
        $alias_2 = "wiper.delfile" ascii wide nocase
        $alias_3 = "trojan.killfiles" ascii wide nocase
        $alias_4 = "destructive.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELFILE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Delfile tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delfile"
        date = "2026-10-16"
    strings:
        $attrib_str = "delfile" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Delfiles (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/delfiles
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELFILES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Delfiles (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delfiles"
        date = "2026-10-16"
    strings:
        $fam_name = "delfiles" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELFILES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Delfiles tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delfiles"
        date = "2026-10-16"
    strings:
        $attrib_str = "delfiles" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Delfinject (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/delfinject
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELFINJECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Delfinject (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delfinject"
        date = "2026-10-16"
    strings:
        $fam_name = "delfinject" ascii wide nocase
        $alias_1 = "trojan:win32/delfinject" ascii wide nocase
        $alias_2 = "virtool:win32/delfinject" ascii wide nocase
        $alias_3 = "trojan.delfinject" ascii wide nocase
        $alias_4 = "win32/delfinject" ascii wide nocase
        $alias_5 = "trojan:win32/delfinject.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELFINJECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Delfinject tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delfinject"
        date = "2026-10-16"
    strings:
        $attrib_str = "delfinject" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Delikle (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/delikle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELIKLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Delikle (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delikle"
        date = "2026-10-16"
    strings:
        $fam_name = "delikle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELIKLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Delikle tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delikle"
        date = "2026-10-16"
    strings:
        $attrib_str = "delikle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Deliric (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/deliric
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELIRIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Deliric (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deliric"
        date = "2026-10-16"
    strings:
        $fam_name = "deliric" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELIRIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Deliric tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deliric"
        date = "2026-10-16"
    strings:
        $attrib_str = "deliric" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Delpem (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/delpem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELPEM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Delpem (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delpem"
        date = "2026-10-16"
    strings:
        $fam_name = "delpem" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELPEM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Delpem tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delpem"
        date = "2026-10-16"
    strings:
        $attrib_str = "delpem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Delphi (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/delphi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELPHI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Delphi (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delphi"
        date = "2026-10-16"
    strings:
        $fam_name = "delphi" ascii wide nocase
        $alias_1 = "win32/delphi" ascii wide nocase
        $alias_2 = "virus:win32/delphi" ascii wide nocase
        $alias_3 = "trojan:win32/delphi" ascii wide nocase
        $alias_4 = "win32.delphi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELPHI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Delphi tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delphi"
        date = "2026-10-16"
    strings:
        $attrib_str = "delphi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Delphinjector (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/delphinjector
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DELPHINJECTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Delphinjector (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delphinjector"
        date = "2026-10-16"
    strings:
        $fam_name = "delphinjector" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DELPHINJECTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Delphinjector tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/delphinjector"
        date = "2026-10-16"
    strings:
        $attrib_str = "delphinjector" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Democry (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/democry
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEMOCRY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Democry (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/democry"
        date = "2026-10-16"
    strings:
        $fam_name = "democry" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEMOCRY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Democry tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/democry"
        date = "2026-10-16"
    strings:
        $attrib_str = "democry" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Demp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/demp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEMP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Demp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/demp"
        date = "2026-10-16"
    strings:
        $fam_name = "demp" ascii wide nocase
        $alias_1 = "ransom:win32/demp" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.demp" ascii wide nocase
        $alias_3 = "win32/demp" ascii wide nocase
        $alias_4 = "ransom.demp" ascii wide nocase
        $alias_5 = "demp ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEMP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Demp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/demp"
        date = "2026-10-16"
    strings:
        $attrib_str = "demp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Denes (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/denes
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DENES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Denes (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/denes"
        date = "2026-10-16"
    strings:
        $fam_name = "denes" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DENES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Denes tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/denes"
        date = "2026-10-16"
    strings:
        $attrib_str = "denes" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dervec (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dervec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DERVEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dervec (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dervec"
        date = "2026-10-16"
    strings:
        $fam_name = "dervec" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DERVEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dervec tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dervec"
        date = "2026-10-16"
    strings:
        $attrib_str = "dervec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Deshacop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/deshacop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DESHACOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Deshacop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deshacop"
        date = "2026-10-16"
    strings:
        $fam_name = "deshacop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DESHACOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Deshacop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/deshacop"
        date = "2026-10-16"
    strings:
        $attrib_str = "deshacop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Desktop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/desktop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DESKTOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Desktop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/desktop"
        date = "2026-10-16"
    strings:
        $fam_name = "desktop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DESKTOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Desktop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/desktop"
        date = "2026-10-16"
    strings:
        $attrib_str = "desktop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Destructbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/destructbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DESTRUCTBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Destructbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/destructbot"
        date = "2026-10-16"
    strings:
        $fam_name = "destructbot" ascii wide nocase
        $alias_1 = "wiper.destructbot" ascii wide nocase
        $alias_2 = "trojan.killdisk.destruct" ascii wide nocase
        $alias_3 = "botnet.destruct" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DESTRUCTBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Destructbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/destructbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "destructbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Desurou (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/desurou
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DESUROU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Desurou (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/desurou"
        date = "2026-10-16"
    strings:
        $fam_name = "desurou" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DESUROU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Desurou tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/desurou"
        date = "2026-10-16"
    strings:
        $attrib_str = "desurou" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Detnat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/detnat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DETNAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Detnat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/detnat"
        date = "2026-10-16"
    strings:
        $fam_name = "detnat" ascii wide nocase
        $alias_1 = "detnat" ascii wide nocase
        $alias_2 = "trojan:win32/detnat" ascii wide nocase
        $alias_3 = "trojan:win32/detnat!mtb" ascii wide nocase
        $alias_4 = "trojan.detnat" ascii wide nocase
        $alias_5 = "win32/detnat" ascii wide nocase
        $alias_6 = "detnat backdoor" ascii wide nocase
        $alias_7 = "downloader.detnat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DETNAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Detnat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/detnat"
        date = "2026-10-16"
    strings:
        $attrib_str = "detnat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Detplock (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/detplock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DETPLOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Detplock (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/detplock"
        date = "2026-10-16"
    strings:
        $fam_name = "detplock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DETPLOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Detplock tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/detplock"
        date = "2026-10-16"
    strings:
        $attrib_str = "detplock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Detrahere (Rootkit)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/detrahere
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DETRAHERE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Detrahere (Rootkit)"
        category = "Rootkit"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/detrahere"
        date = "2026-10-16"
    strings:
        $fam_name = "detrahere" ascii wide nocase
        $alias_1 = "trojan:win32/detrahere" ascii wide nocase
        $alias_2 = "trojan:win64/detrahere.s" ascii wide nocase
        $alias_3 = "rootkit.detrahere" ascii wide nocase
        $alias_4 = "win32/detrahere" ascii wide nocase
        $alias_5 = "trojan:win32/detrahere!rfn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DETRAHERE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Detrahere tradecraft"
        category = "Rootkit"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/detrahere"
        date = "2026-10-16"
    strings:
        $attrib_str = "detrahere" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Detroie (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/detroie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DETROIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Detroie (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/detroie"
        date = "2026-10-16"
    strings:
        $fam_name = "detroie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DETROIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Detroie tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/detroie"
        date = "2026-10-16"
    strings:
        $attrib_str = "detroie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Devilz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/devilz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEVILZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Devilz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/devilz"
        date = "2026-10-16"
    strings:
        $fam_name = "devilz" ascii wide nocase
        $alias_1 = "trojan.devilz" ascii wide nocase
        $alias_2 = "downloader.devilz" ascii wide nocase
        $alias_3 = "win32/devilz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEVILZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Devilz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/devilz"
        date = "2026-10-16"
    strings:
        $attrib_str = "devilz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dexel (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dexel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DEXEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dexel (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dexel"
        date = "2026-10-16"
    strings:
        $fam_name = "dexel" ascii wide nocase
        $alias_1 = "trojan:win32/dexel" ascii wide nocase
        $alias_2 = "trojandownloader:win32/dexel" ascii wide nocase
        $alias_3 = "backdoor:win32/dexel" ascii wide nocase
        $alias_4 = "win32/dexel" ascii wide nocase
        $alias_5 = "downloader.dexel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DEXEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dexel tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dexel"
        date = "2026-10-16"
    strings:
        $attrib_str = "dexel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dfay (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dfay
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DFAY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dfay (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dfay"
        date = "2026-10-16"
    strings:
        $fam_name = "dfay" ascii wide nocase
        $alias_1 = "dfay" ascii wide nocase
        $alias_2 = "trojandropper:win32/dfay" ascii wide nocase
        $alias_3 = "trojan.dfay" ascii wide nocase
        $alias_4 = "win32/dfay" ascii wide nocase
        $alias_5 = "dfay dropper" ascii wide nocase
        $alias_6 = "trojan:win32/dfay" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DFAY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dfay tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dfay"
        date = "2026-10-16"
    strings:
        $attrib_str = "dfay" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dial (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dial
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DIAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dial (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dial"
        date = "2026-10-16"
    strings:
        $fam_name = "dial" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DIAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dial tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dial"
        date = "2026-10-16"
    strings:
        $attrib_str = "dial" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Diamin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/diamin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DIAMIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Diamin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/diamin"
        date = "2026-10-16"
    strings:
        $fam_name = "diamin" ascii wide nocase
        $alias_1 = "trojan.diamin" ascii wide nocase
        $alias_2 = "downloader.diamin" ascii wide nocase
        $alias_3 = "win32/diamin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DIAMIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Diamin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/diamin"
        date = "2026-10-16"
    strings:
        $attrib_str = "diamin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dico (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dico
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DICO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dico (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dico"
        date = "2026-10-16"
    strings:
        $fam_name = "dico" ascii wide nocase
        $alias_1 = "ransom:win32/dico" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.dico" ascii wide nocase
        $alias_3 = "win32/dico" ascii wide nocase
        $alias_4 = "dico ransomware" ascii wide nocase
        $alias_5 = "ransom.dico" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DICO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dico tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dico"
        date = "2026-10-16"
    strings:
        $attrib_str = "dico" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dicsor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dicsor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DICSOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dicsor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dicsor"
        date = "2026-10-16"
    strings:
        $fam_name = "dicsor" ascii wide nocase
        $alias_1 = "trojan.dicsor" ascii wide nocase
        $alias_2 = "downloader.dicsor" ascii wide nocase
        $alias_3 = "win32/dicsor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DICSOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dicsor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dicsor"
        date = "2026-10-16"
    strings:
        $attrib_str = "dicsor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dimnie (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dimnie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DIMNIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dimnie (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dimnie"
        date = "2026-10-16"
    strings:
        $fam_name = "dimnie" ascii wide nocase
        $alias_1 = "trojan:win32/dimnie" ascii wide nocase
        $alias_2 = "pws:win32/dimnie" ascii wide nocase
        $alias_3 = "trojan.dimnie" ascii wide nocase
        $alias_4 = "dimnie stealer" ascii wide nocase
        $alias_5 = "win32/dimnie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DIMNIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dimnie tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dimnie"
        date = "2026-10-16"
    strings:
        $attrib_str = "dimnie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dinwod (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dinwod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DINWOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dinwod (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dinwod"
        date = "2026-10-16"
    strings:
        $fam_name = "dinwod" ascii wide nocase
        $alias_1 = "trojan:win32/dinwod!rfn" ascii wide nocase
        $alias_2 = "trojandropper:win32/dinwod" ascii wide nocase
        $alias_3 = "trojan.win32.dinwod.b" ascii wide nocase
        $alias_4 = "win32/dinwod" ascii wide nocase
        $alias_5 = "dinwod.dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DINWOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dinwod tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dinwod"
        date = "2026-10-16"
    strings:
        $attrib_str = "dinwod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Directdownloader (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/directdownloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DIRECTDOWNLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Directdownloader (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/directdownloader"
        date = "2026-10-16"
    strings:
        $fam_name = "directdownloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DIRECTDOWNLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Directdownloader tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/directdownloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "directdownloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Disabler (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/disabler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DISABLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Disabler (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/disabler"
        date = "2026-10-16"
    strings:
        $fam_name = "disabler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DISABLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Disabler tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/disabler"
        date = "2026-10-16"
    strings:
        $attrib_str = "disabler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Disfa (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/disfa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DISFA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Disfa (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/disfa"
        date = "2026-10-16"
    strings:
        $fam_name = "disfa" ascii wide nocase
        $alias_1 = "trojan:win32/disfa" ascii wide nocase
        $alias_2 = "trojan.msil.disfa" ascii wide nocase
        $alias_3 = "backdoor:msil/bladabindi" ascii wide nocase
        $alias_4 = "disfa.rat" ascii wide nocase
        $alias_5 = "win32/disfa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DISFA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Disfa tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/disfa"
        date = "2026-10-16"
    strings:
        $attrib_str = "disfa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dishigy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dishigy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DISHIGY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dishigy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dishigy"
        date = "2026-10-16"
    strings:
        $fam_name = "dishigy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DISHIGY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dishigy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dishigy"
        date = "2026-10-16"
    strings:
        $attrib_str = "dishigy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Diskscanfa (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/diskscanfa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DISKSCANFA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Diskscanfa (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/diskscanfa"
        date = "2026-10-16"
    strings:
        $fam_name = "diskscanfa" ascii wide nocase
        $alias_1 = "rogue.diskscanfa" ascii wide nocase
        $alias_2 = "fakeav.diskscan" ascii wide nocase
        $alias_3 = "win32/fakeav" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DISKSCANFA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Diskscanfa tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/diskscanfa"
        date = "2026-10-16"
    strings:
        $attrib_str = "diskscanfa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Diskwriter (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/diskwriter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DISKWRITER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Diskwriter (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/diskwriter"
        date = "2026-10-16"
    strings:
        $fam_name = "diskwriter" ascii wide nocase
        $alias_1 = "trojan:win32/diskwriter" ascii wide nocase
        $alias_2 = "wiper:win32/diskwriter" ascii wide nocase
        $alias_3 = "win32/diskwriter" ascii wide nocase
        $alias_4 = "diskwriter wiper" ascii wide nocase
        $alias_5 = "diskwriter mbr destroyer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DISKWRITER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Diskwriter tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/diskwriter"
        date = "2026-10-16"
    strings:
        $attrib_str = "diskwriter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Diss (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/diss
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DISS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Diss (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/diss"
        date = "2026-10-16"
    strings:
        $fam_name = "diss" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DISS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Diss tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/diss"
        date = "2026-10-16"
    strings:
        $attrib_str = "diss" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for District (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/district
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DISTRICT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for District (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/district"
        date = "2026-10-16"
    strings:
        $fam_name = "district" ascii wide nocase
        $alias_1 = "trojan.district" ascii wide nocase
        $alias_2 = "downloader.district" ascii wide nocase
        $alias_3 = "win32/district" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DISTRICT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for District tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/district"
        date = "2026-10-16"
    strings:
        $attrib_str = "district" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ditertag (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ditertag
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DITERTAG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ditertag (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ditertag"
        date = "2026-10-16"
    strings:
        $fam_name = "ditertag" ascii wide nocase
        $alias_1 = "trojan.ditertag" ascii wide nocase
        $alias_2 = "downloader.ditertag" ascii wide nocase
        $alias_3 = "win32/ditertag" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DITERTAG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ditertag tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ditertag"
        date = "2026-10-16"
    strings:
        $attrib_str = "ditertag" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Diztakun (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/diztakun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DIZTAKUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Diztakun (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/diztakun"
        date = "2026-10-16"
    strings:
        $fam_name = "diztakun" ascii wide nocase
        $alias_1 = "trojan:win32/diztakun" ascii wide nocase
        $alias_2 = "trojan.win32.diztakun" ascii wide nocase
        $alias_3 = "spyware.diztakun" ascii wide nocase
        $alias_4 = "win32/diztakun" ascii wide nocase
        $alias_5 = "trojan:win32/diztakun!rfn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DIZTAKUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Diztakun tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/diztakun"
        date = "2026-10-16"
    strings:
        $attrib_str = "diztakun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dlassistant (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dlassistant
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLASSISTANT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dlassistant (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlassistant"
        date = "2026-10-16"
    strings:
        $fam_name = "dlassistant" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLASSISTANT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dlassistant tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlassistant"
        date = "2026-10-16"
    strings:
        $attrib_str = "dlassistant" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dlboost (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dlboost
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLBOOST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dlboost (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlboost"
        date = "2026-10-16"
    strings:
        $fam_name = "dlboost" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLBOOST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dlboost tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlboost"
        date = "2026-10-16"
    strings:
        $attrib_str = "dlboost" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dlguide (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dlguide
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLGUIDE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dlguide (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlguide"
        date = "2026-10-16"
    strings:
        $fam_name = "dlguide" ascii wide nocase
        $alias_1 = "pua:win32/downloadguide" ascii wide nocase
        $alias_2 = "adware:win32/downloadguide" ascii wide nocase
        $alias_3 = "win32/downloadguide.bundler" ascii wide nocase
        $alias_4 = "pup.optional.downloadguide" ascii wide nocase
        $alias_5 = "adware.downloadguide" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLGUIDE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dlguide tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlguide"
        date = "2026-10-16"
    strings:
        $attrib_str = "dlguide" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dlhelper (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dlhelper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLHELPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dlhelper (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlhelper"
        date = "2026-10-16"
    strings:
        $fam_name = "dlhelper" ascii wide nocase
        $alias_1 = "softwarebundler:win32/dlhelper" ascii wide nocase
        $alias_2 = "pua:win32/dlhelper" ascii wide nocase
        $alias_3 = "adware.dlhelper" ascii wide nocase
        $alias_4 = "win32/dlhelper" ascii wide nocase
        $alias_5 = "dlhelper.bundler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLHELPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dlhelper tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlhelper"
        date = "2026-10-16"
    strings:
        $attrib_str = "dlhelper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dllhijack (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dllhijack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLLHIJACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dllhijack (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dllhijack"
        date = "2026-10-16"
    strings:
        $fam_name = "dllhijack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLLHIJACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dllhijack tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dllhijack"
        date = "2026-10-16"
    strings:
        $attrib_str = "dllhijack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dllhijacker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dllhijacker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLLHIJACKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dllhijacker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dllhijacker"
        date = "2026-10-16"
    strings:
        $fam_name = "dllhijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLLHIJACKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dllhijacker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dllhijacker"
        date = "2026-10-16"
    strings:
        $attrib_str = "dllhijacker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dllinject (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dllinject
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLLINJECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dllinject (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dllinject"
        date = "2026-10-16"
    strings:
        $fam_name = "dllinject" ascii wide nocase
        $alias_1 = "trojan:win32/dllinject" ascii wide nocase
        $alias_2 = "hacktool:win32/dllinject" ascii wide nocase
        $alias_3 = "msil/dllinject" ascii wide nocase
        $alias_4 = "win32/dllinject.mtb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLLINJECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dllinject tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dllinject"
        date = "2026-10-16"
    strings:
        $attrib_str = "dllinject" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dlsecure (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dlsecure
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLSECURE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dlsecure (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlsecure"
        date = "2026-10-16"
    strings:
        $fam_name = "dlsecure" ascii wide nocase
        $alias_1 = "rogue.dlsecure" ascii wide nocase
        $alias_2 = "fakeav.dlsecure" ascii wide nocase
        $alias_3 = "scareware.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLSECURE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dlsecure tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlsecure"
        date = "2026-10-16"
    strings:
        $attrib_str = "dlsecure" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dlsponsor (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dlsponsor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLSPONSOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dlsponsor (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlsponsor"
        date = "2026-10-16"
    strings:
        $fam_name = "dlsponsor" ascii wide nocase
        $alias_1 = "puadlmanager:win32/downloadsponsor" ascii wide nocase
        $alias_2 = "adware:win32/downloadsponsor" ascii wide nocase
        $alias_3 = "program:win32/downloadsponsor" ascii wide nocase
        $alias_4 = "pua.downloadsponsor" ascii wide nocase
        $alias_5 = "win32/downloadsponsor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLSPONSOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dlsponsor tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlsponsor"
        date = "2026-10-16"
    strings:
        $attrib_str = "dlsponsor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dluca (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dluca
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLUCA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dluca (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dluca"
        date = "2026-10-16"
    strings:
        $fam_name = "dluca" ascii wide nocase
        $alias_1 = "trojan.dluca" ascii wide nocase
        $alias_2 = "downloader.dluca" ascii wide nocase
        $alias_3 = "win32/dluca" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLUCA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dluca tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dluca"
        date = "2026-10-16"
    strings:
        $attrib_str = "dluca" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dlzp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dlzp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DLZP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dlzp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlzp"
        date = "2026-10-16"
    strings:
        $fam_name = "dlzp" ascii wide nocase
        $alias_1 = "trojan.dlzp" ascii wide nocase
        $alias_2 = "downloader.dlzp" ascii wide nocase
        $alias_3 = "win32/dlzp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DLZP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dlzp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dlzp"
        date = "2026-10-16"
    strings:
        $attrib_str = "dlzp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dnguard (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dnguard
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DNGUARD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dnguard (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dnguard"
        date = "2026-10-16"
    strings:
        $fam_name = "dnguard" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DNGUARD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dnguard tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dnguard"
        date = "2026-10-16"
    strings:
        $attrib_str = "dnguard" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dnschange (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dnschange
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DNSCHANGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dnschange (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dnschange"
        date = "2026-10-16"
    strings:
        $fam_name = "dnschange" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DNSCHANGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dnschange tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dnschange"
        date = "2026-10-16"
    strings:
        $attrib_str = "dnschange" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dnschanger (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dnschanger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DNSCHANGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dnschanger (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dnschanger"
        date = "2026-10-16"
    strings:
        $fam_name = "dnschanger" ascii wide nocase
        $alias_1 = "dnschanger" ascii wide nocase
        $alias_2 = "trojan.dnschanger" ascii wide nocase
        $alias_3 = "win32/dnschanger" ascii wide nocase
        $alias_4 = "osx.dnschanger" ascii wide nocase
        $alias_5 = "rove digital" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DNSCHANGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dnschanger tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dnschanger"
        date = "2026-10-16"
    strings:
        $attrib_str = "dnschanger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dnscleaner (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dnscleaner
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DNSCLEANER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dnscleaner (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dnscleaner"
        date = "2026-10-16"
    strings:
        $fam_name = "dnscleaner" ascii wide nocase
        $alias_1 = "pua:win32/dnscleaner" ascii wide nocase
        $alias_2 = "rogue:win32/dnscleaner" ascii wide nocase
        $alias_3 = "program:win32/dnscleaner" ascii wide nocase
        $alias_4 = "dnscleaner utility" ascii wide nocase
        $alias_5 = "win32/dnscleaner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DNSCLEANER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dnscleaner tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dnscleaner"
        date = "2026-10-16"
    strings:
        $attrib_str = "dnscleaner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dodiw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dodiw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DODIW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dodiw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dodiw"
        date = "2026-10-16"
    strings:
        $fam_name = "dodiw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DODIW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dodiw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dodiw"
        date = "2026-10-16"
    strings:
        $attrib_str = "dodiw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dofoil (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dofoil
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOFOIL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dofoil (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dofoil"
        date = "2026-10-16"
    strings:
        $fam_name = "dofoil" ascii wide nocase
        $alias_1 = "trojan:win32/dofoil" ascii wide nocase
        $alias_2 = "smokeloader" ascii wide nocase
        $alias_3 = "smoke loader" ascii wide nocase
        $alias_4 = "trojandownloader:win32/dofoil" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOFOIL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dofoil tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dofoil"
        date = "2026-10-16"
    strings:
        $attrib_str = "dofoil" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Domaiq (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/domaiq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOMAIQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Domaiq (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/domaiq"
        date = "2026-10-16"
    strings:
        $fam_name = "domaiq" ascii wide nocase
        $alias_1 = "pua:win32/domaiq" ascii wide nocase
        $alias_2 = "adware:win32/domaiq" ascii wide nocase
        $alias_3 = "program:win32/domaiq" ascii wide nocase
        $alias_4 = "domiq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOMAIQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Domaiq tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/domaiq"
        date = "2026-10-16"
    strings:
        $attrib_str = "domaiq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dominator (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dominator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOMINATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dominator (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dominator"
        date = "2026-10-16"
    strings:
        $fam_name = "dominator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOMINATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dominator tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dominator"
        date = "2026-10-16"
    strings:
        $attrib_str = "dominator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Donex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/donex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DONEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Donex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/donex"
        date = "2026-10-16"
    strings:
        $fam_name = "donex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DONEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Donex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/donex"
        date = "2026-10-16"
    strings:
        $attrib_str = "donex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Donise (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/donise
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DONISE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Donise (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/donise"
        date = "2026-10-16"
    strings:
        $fam_name = "donise" ascii wide nocase
        $alias_1 = "trojan.donise" ascii wide nocase
        $alias_2 = "downloader.donise" ascii wide nocase
        $alias_3 = "win32/donise" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DONISE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Donise tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/donise"
        date = "2026-10-16"
    strings:
        $attrib_str = "donise" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Donloz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/donloz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DONLOZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Donloz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/donloz"
        date = "2026-10-16"
    strings:
        $fam_name = "donloz" ascii wide nocase
        $alias_1 = "downloader.donloz" ascii wide nocase
        $alias_2 = "trojan.donloz" ascii wide nocase
        $alias_3 = "win32/donloz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DONLOZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Donloz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/donloz"
        date = "2026-10-16"
    strings:
        $attrib_str = "donloz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Donn (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/donn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DONN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Donn (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/donn"
        date = "2026-10-16"
    strings:
        $fam_name = "donn" ascii wide nocase
        $alias_1 = "trojan.donn" ascii wide nocase
        $alias_2 = "downloader.donn" ascii wide nocase
        $alias_3 = "win32/donn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DONN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Donn tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/donn"
        date = "2026-10-16"
    strings:
        $attrib_str = "donn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Donut (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/donut
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DONUT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Donut (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/donut"
        date = "2026-10-16"
    strings:
        $fam_name = "donut" ascii wide nocase
        $alias_1 = "hacktool.donut" ascii wide nocase
        $alias_2 = "tool.donutshellcode" ascii wide nocase
        $alias_3 = "riskware.donut" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DONUT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Donut tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/donut"
        date = "2026-10-16"
    strings:
        $attrib_str = "donut" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Doqv (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/doqv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOQV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Doqv (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/doqv"
        date = "2026-10-16"
    strings:
        $fam_name = "doqv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOQV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Doqv tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/doqv"
        date = "2026-10-16"
    strings:
        $attrib_str = "doqv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dorgam (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dorgam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DORGAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dorgam (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dorgam"
        date = "2026-10-16"
    strings:
        $fam_name = "dorgam" ascii wide nocase
        $alias_1 = "trojan.dorgam" ascii wide nocase
        $alias_2 = "downloader.dorgam" ascii wide nocase
        $alias_3 = "win32/dorgam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DORGAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dorgam tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dorgam"
        date = "2026-10-16"
    strings:
        $attrib_str = "dorgam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dorifel (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dorifel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DORIFEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dorifel (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dorifel"
        date = "2026-10-16"
    strings:
        $fam_name = "dorifel" ascii wide nocase
        $alias_1 = "trojan:win32/dorifel" ascii wide nocase
        $alias_2 = "virus:win32/dorifel" ascii wide nocase
        $alias_3 = "worm:win32/dorifel" ascii wide nocase
        $alias_4 = "win32/quervar" ascii wide nocase
        $alias_5 = "virus:win32/dorifel.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DORIFEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dorifel tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dorifel"
        date = "2026-10-16"
    strings:
        $attrib_str = "dorifel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dorkbot (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dorkbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DORKBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dorkbot (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dorkbot"
        date = "2026-10-16"
    strings:
        $fam_name = "dorkbot" ascii wide nocase
        $alias_1 = "worm:win32/dorkbot" ascii wide nocase
        $alias_2 = "ngrbot" ascii wide nocase
        $alias_3 = "backdoor.win32.ngrbot" ascii wide nocase
        $alias_4 = "w32/dorkbot.worm" ascii wide nocase
        $alias_5 = "trojan.dorkbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DORKBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dorkbot tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dorkbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "dorkbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dorv (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dorv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DORV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dorv (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dorv"
        date = "2026-10-16"
    strings:
        $fam_name = "dorv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DORV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dorv tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dorv"
        date = "2026-10-16"
    strings:
        $attrib_str = "dorv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Doser (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/doser
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOSER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Doser (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/doser"
        date = "2026-10-16"
    strings:
        $fam_name = "doser" ascii wide nocase
        $alias_1 = "hacktool.doser" ascii wide nocase
        $alias_2 = "trojan.ddos.doser" ascii wide nocase
        $alias_3 = "win32/doser" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOSER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Doser tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/doser"
        date = "2026-10-16"
    strings:
        $attrib_str = "doser" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dostre (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dostre
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOSTRE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dostre (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dostre"
        date = "2026-10-16"
    strings:
        $fam_name = "dostre" ascii wide nocase
        $alias_1 = "trojan:win32/dostre" ascii wide nocase
        $alias_2 = "ransom:win32/dostre" ascii wide nocase
        $alias_3 = "trojan.dostre" ascii wide nocase
        $alias_4 = "win32/dostre" ascii wide nocase
        $alias_5 = "trojan:win32/dostre.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOSTRE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dostre tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dostre"
        date = "2026-10-16"
    strings:
        $attrib_str = "dostre" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dotbundle (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dotbundle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOTBUNDLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dotbundle (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dotbundle"
        date = "2026-10-16"
    strings:
        $fam_name = "dotbundle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOTBUNDLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dotbundle tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dotbundle"
        date = "2026-10-16"
    strings:
        $attrib_str = "dotbundle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dotdo (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dotdo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOTDO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dotdo (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dotdo"
        date = "2026-10-16"
    strings:
        $fam_name = "dotdo" ascii wide nocase
        $alias_1 = "adware:win32/dotdo" ascii wide nocase
        $alias_2 = "trojan:win32/dotdo" ascii wide nocase
        $alias_3 = "win32/dotdo" ascii wide nocase
        $alias_4 = "adware.dotdo" ascii wide nocase
        $alias_5 = "pua.win32.dotdo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOTDO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dotdo tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dotdo"
        date = "2026-10-16"
    strings:
        $attrib_str = "dotdo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dothetuk (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dothetuk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOTHETUK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dothetuk (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dothetuk"
        date = "2026-10-16"
    strings:
        $fam_name = "dothetuk" ascii wide nocase
        $alias_1 = "trojan:msil/dothetuk.a" ascii wide nocase
        $alias_2 = "adware:win32/dothetuk" ascii wide nocase
        $alias_3 = "spyware.dothetuk" ascii wide nocase
        $alias_4 = "win32/dothetuk" ascii wide nocase
        $alias_5 = "msil.dothetuk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOTHETUK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dothetuk tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dothetuk"
        date = "2026-10-16"
    strings:
        $attrib_str = "dothetuk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dotnet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dotnet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOTNET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dotnet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dotnet"
        date = "2026-10-16"
    strings:
        $fam_name = "dotnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOTNET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dotnet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dotnet"
        date = "2026-10-16"
    strings:
        $attrib_str = "dotnet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dotto (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dotto
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOTTO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dotto (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dotto"
        date = "2026-10-16"
    strings:
        $fam_name = "dotto" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOTTO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dotto tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dotto"
        date = "2026-10-16"
    strings:
        $attrib_str = "dotto" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Doubleagent (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/doubleagent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOUBLEAGENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Doubleagent (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/doubleagent"
        date = "2026-10-16"
    strings:
        $fam_name = "doubleagent" ascii wide nocase
        $alias_1 = "hacktool.doubleagent" ascii wide nocase
        $alias_2 = "exploit.applicationverifier" ascii wide nocase
        $alias_3 = "riskware.doubleagent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOUBLEAGENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Doubleagent tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/doubleagent"
        date = "2026-10-16"
    strings:
        $attrib_str = "doubleagent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Doublefantasy (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/doublefantasy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOUBLEFANTASY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Doublefantasy (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/doublefantasy"
        date = "2026-10-16"
    strings:
        $fam_name = "doublefantasy" ascii wide nocase
        $alias_1 = "backdoor.doublefantasy" ascii wide nocase
        $alias_2 = "equationgroup.doublefantasy" ascii wide nocase
        $alias_3 = "trojan.win32.doublefantasy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOUBLEFANTASY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Doublefantasy tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/doublefantasy"
        date = "2026-10-16"
    strings:
        $attrib_str = "doublefantasy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Dovs (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dovs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOVS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dovs (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dovs"
        date = "2026-10-16"
    strings:
        $fam_name = "dovs" ascii wide nocase
        $alias_1 = "trojan:win32/dovs" ascii wide nocase
        $alias_2 = "trojandownloader:win32/dovs" ascii wide nocase
        $alias_3 = "win32/dovs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOVS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dovs tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dovs"
        date = "2026-10-16"
    strings:
        $attrib_str = "dovs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dowanun (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dowanun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOWANUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dowanun (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dowanun"
        date = "2026-10-16"
    strings:
        $fam_name = "dowanun" ascii wide nocase
        $alias_1 = "trojan.dowanun" ascii wide nocase
        $alias_2 = "downloader.dowanun" ascii wide nocase
        $alias_3 = "win32/dowanun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOWANUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dowanun tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dowanun"
        date = "2026-10-16"
    strings:
        $attrib_str = "dowanun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Downeks (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/downeks
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOWNEKS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Downeks (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downeks"
        date = "2026-10-16"
    strings:
        $fam_name = "downeks" ascii wide nocase
        $alias_1 = "trojandownloader:win32/downeks" ascii wide nocase
        $alias_2 = "trojan:win32/downeks" ascii wide nocase
        $alias_3 = "trojan.downeks" ascii wide nocase
        $alias_4 = "win32/downeks" ascii wide nocase
        $alias_5 = "trojandownloader:win32/downeks.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOWNEKS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Downeks tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downeks"
        date = "2026-10-16"
    strings:
        $attrib_str = "downeks" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Downer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/downer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOWNER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Downer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downer"
        date = "2026-10-16"
    strings:
        $fam_name = "downer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOWNER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Downer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downer"
        date = "2026-10-16"
    strings:
        $attrib_str = "downer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Downexec (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/downexec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOWNEXEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Downexec (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downexec"
        date = "2026-10-16"
    strings:
        $fam_name = "downexec" ascii wide nocase
        $alias_1 = "trojan.downloader.downexec" ascii wide nocase
        $alias_2 = "win32/downexec" ascii wide nocase
        $alias_3 = "downloader.generic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOWNEXEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Downexec tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downexec"
        date = "2026-10-16"
    strings:
        $attrib_str = "downexec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Downloadadmin (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/downloadadmin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOWNLOADADMIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Downloadadmin (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloadadmin"
        date = "2026-10-16"
    strings:
        $fam_name = "downloadadmin" ascii wide nocase
        $alias_1 = "pua:win32/downloadadmin" ascii wide nocase
        $alias_2 = "program:win32/downloadadmin" ascii wide nocase
        $alias_3 = "downloadadmin" ascii wide nocase
        $alias_4 = "win32/downloadadmin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOWNLOADADMIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Downloadadmin tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloadadmin"
        date = "2026-10-16"
    strings:
        $attrib_str = "downloadadmin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Downloadassistant (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/downloadassistant
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOWNLOADASSISTANT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Downloadassistant (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloadassistant"
        date = "2026-10-16"
    strings:
        $fam_name = "downloadassistant" ascii wide nocase
        $alias_1 = "browsermodifier:win32/downloadassistant" ascii wide nocase
        $alias_2 = "adware:win32/downloadassistant" ascii wide nocase
        $alias_3 = "pua:win32/downloadassistant" ascii wide nocase
        $alias_4 = "win32/downloadassistant" ascii wide nocase
        $alias_5 = "downloadassistant toolbar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOWNLOADASSISTANT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Downloadassistant tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloadassistant"
        date = "2026-10-16"
    strings:
        $attrib_str = "downloadassistant" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Downloaderb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/downloaderb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOWNLOADERB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Downloaderb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloaderb"
        date = "2026-10-16"
    strings:
        $fam_name = "downloaderb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOWNLOADERB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Downloaderb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloaderb"
        date = "2026-10-16"
    strings:
        $attrib_str = "downloaderb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Downloadhelper (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/downloadhelper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOWNLOADHELPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Downloadhelper (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloadhelper"
        date = "2026-10-16"
    strings:
        $fam_name = "downloadhelper" ascii wide nocase
        $alias_1 = "adware:win32/downloadhelper" ascii wide nocase
        $alias_2 = "pua.downloadhelper" ascii wide nocase
        $alias_3 = "adware.toolbar.downloadhelper" ascii wide nocase
        $alias_4 = "win32/downloadhelper.adware" ascii wide nocase
        $alias_5 = "trojan-clicker.downloadhelper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOWNLOADHELPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Downloadhelper tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloadhelper"
        date = "2026-10-16"
    strings:
        $attrib_str = "downloadhelper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Downloadshield (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/downloadshield
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOWNLOADSHIELD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Downloadshield (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloadshield"
        date = "2026-10-16"
    strings:
        $fam_name = "downloadshield" ascii wide nocase
        $alias_1 = "pua:win32/downloadshield" ascii wide nocase
        $alias_2 = "softwarebundler:win32/downloadshield" ascii wide nocase
        $alias_3 = "adware:win32/downloadshield" ascii wide nocase
        $alias_4 = "pup.optional.downloadshield" ascii wide nocase
        $alias_5 = "program:win32/downloadshield" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOWNLOADSHIELD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Downloadshield tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloadshield"
        date = "2026-10-16"
    strings:
        $attrib_str = "downloadshield" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Downloadsoft (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/downloadsoft
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOWNLOADSOFT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Downloadsoft (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloadsoft"
        date = "2026-10-16"
    strings:
        $fam_name = "downloadsoft" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOWNLOADSOFT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Downloadsoft tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/downloadsoft"
        date = "2026-10-16"
    strings:
        $attrib_str = "downloadsoft" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Doyo (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/doyo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DOYO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Doyo (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/doyo"
        date = "2026-10-16"
    strings:
        $fam_name = "doyo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DOYO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Doyo tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/doyo"
        date = "2026-10-16"
    strings:
        $attrib_str = "doyo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Dragonbot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dragonbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRAGONBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dragonbot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dragonbot"
        date = "2026-10-16"
    strings:
        $fam_name = "dragonbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRAGONBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dragonbot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dragonbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "dragonbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dreambot (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dreambot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DREAMBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dreambot (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dreambot"
        date = "2026-10-16"
    strings:
        $fam_name = "dreambot" ascii wide nocase
        $alias_1 = "trojan:win32/dreambot" ascii wide nocase
        $alias_2 = "trojan:win32/ursnif.dreambot" ascii wide nocase
        $alias_3 = "win32/dreambot" ascii wide nocase
        $alias_4 = "dreambot banking trojan" ascii wide nocase
        $alias_5 = "ursnif-dreambot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DREAMBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dreambot tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dreambot"
        date = "2026-10-16"
    strings:
        $attrib_str = "dreambot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Drefir (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/drefir
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DREFIR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Drefir (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drefir"
        date = "2026-10-16"
    strings:
        $fam_name = "drefir" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DREFIR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Drefir tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drefir"
        date = "2026-10-16"
    strings:
        $attrib_str = "drefir" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dridex (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dridex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRIDEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dridex (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dridex"
        date = "2026-10-16"
    strings:
        $fam_name = "dridex" ascii wide nocase
        $alias_1 = "dridex" ascii wide nocase
        $alias_2 = "bugat v5" ascii wide nocase
        $alias_3 = "cridex" ascii wide nocase
        $alias_4 = "bugat" ascii wide nocase
        $alias_5 = "w32.cridex" ascii wide nocase
        $alias_6 = "trojan:win32/dridex" ascii wide nocase
        $alias_7 = "evil corp dridex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRIDEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dridex tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dridex"
        date = "2026-10-16"
    strings:
        $attrib_str = "dridex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Driverassist (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/driverassist
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRIVERASSIST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Driverassist (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverassist"
        date = "2026-10-16"
    strings:
        $fam_name = "driverassist" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRIVERASSIST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Driverassist tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverassist"
        date = "2026-10-16"
    strings:
        $attrib_str = "driverassist" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Driverbooster (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/driverbooster
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRIVERBOOSTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Driverbooster (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverbooster"
        date = "2026-10-16"
    strings:
        $fam_name = "driverbooster" ascii wide nocase
        $alias_1 = "pup.driverbooster" ascii wide nocase
        $alias_2 = "rogue.iobit" ascii wide nocase
        $alias_3 = "riskware.driverupdater" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRIVERBOOSTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Driverbooster tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverbooster"
        date = "2026-10-16"
    strings:
        $attrib_str = "driverbooster" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Driverdevelop (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/driverdevelop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRIVERDEVELOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Driverdevelop (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverdevelop"
        date = "2026-10-16"
    strings:
        $fam_name = "driverdevelop" ascii wide nocase
        $alias_1 = "rootkit.driverdevelop" ascii wide nocase
        $alias_2 = "riskware.baddriver" ascii wide nocase
        $alias_3 = "trojan.sys.driverdevelop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRIVERDEVELOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Driverdevelop tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverdevelop"
        date = "2026-10-16"
    strings:
        $attrib_str = "driverdevelop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Driverpack (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/driverpack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRIVERPACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Driverpack (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverpack"
        date = "2026-10-16"
    strings:
        $fam_name = "driverpack" ascii wide nocase
        $alias_1 = "pua:win32/driverpack" ascii wide nocase
        $alias_2 = "adware:win32/driverpack" ascii wide nocase
        $alias_3 = "pup.optional.driverpacksolution" ascii wide nocase
        $alias_4 = "win32/driverpack.adware" ascii wide nocase
        $alias_5 = "driverpacksolution.pup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRIVERPACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Driverpack tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverpack"
        date = "2026-10-16"
    strings:
        $attrib_str = "driverpack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Drivertalent (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/drivertalent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRIVERTALENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Drivertalent (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drivertalent"
        date = "2026-10-16"
    strings:
        $fam_name = "drivertalent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRIVERTALENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Drivertalent tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drivertalent"
        date = "2026-10-16"
    strings:
        $attrib_str = "drivertalent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Driverturbo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/driverturbo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRIVERTURBO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Driverturbo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverturbo"
        date = "2026-10-16"
    strings:
        $fam_name = "driverturbo" ascii wide nocase
        $alias_1 = "rogue.driverturbo" ascii wide nocase
        $alias_2 = "pup.fakeoptimizer" ascii wide nocase
        $alias_3 = "scareware.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRIVERTURBO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Driverturbo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverturbo"
        date = "2026-10-16"
    strings:
        $attrib_str = "driverturbo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Driverupdate (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/driverupdate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRIVERUPDATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Driverupdate (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverupdate"
        date = "2026-10-16"
    strings:
        $fam_name = "driverupdate" ascii wide nocase
        $alias_1 = "pua:win32/driverupdate" ascii wide nocase
        $alias_2 = "program:win32/driverupdate" ascii wide nocase
        $alias_3 = "driverupdate scareware" ascii wide nocase
        $alias_4 = "rogue:win32/driverupdate" ascii wide nocase
        $alias_5 = "win32/driverupdate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRIVERUPDATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Driverupdate tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverupdate"
        date = "2026-10-16"
    strings:
        $attrib_str = "driverupdate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Driverupdater (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/driverupdater
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRIVERUPDATER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Driverupdater (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverupdater"
        date = "2026-10-16"
    strings:
        $fam_name = "driverupdater" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRIVERUPDATER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Driverupdater tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/driverupdater"
        date = "2026-10-16"
    strings:
        $attrib_str = "driverupdater" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Drmsoft (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/drmsoft
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DRMSOFT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Drmsoft (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drmsoft"
        date = "2026-10-16"
    strings:
        $fam_name = "drmsoft" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DRMSOFT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Drmsoft tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drmsoft"
        date = "2026-10-16"
    strings:
        $attrib_str = "drmsoft" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Drolnux (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/drolnux
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DROLNUX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Drolnux (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drolnux"
        date = "2026-10-16"
    strings:
        $fam_name = "drolnux" ascii wide nocase
        $alias_1 = "worm:win32/drolnux" ascii wide nocase
        $alias_2 = "worm:win32/drolnux.a" ascii wide nocase
        $alias_3 = "w32/drolnux" ascii wide nocase
        $alias_4 = "trojan.win32.drolnux" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DROLNUX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Drolnux tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drolnux"
        date = "2026-10-16"
    strings:
        $attrib_str = "drolnux" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Droma (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/droma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DROMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Droma (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/droma"
        date = "2026-10-16"
    strings:
        $fam_name = "droma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DROMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Droma tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/droma"
        date = "2026-10-16"
    strings:
        $attrib_str = "droma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Drooptroop (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/drooptroop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DROOPTROOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Drooptroop (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drooptroop"
        date = "2026-10-16"
    strings:
        $fam_name = "drooptroop" ascii wide nocase
        $alias_1 = "trojan.dropper.drooptroop" ascii wide nocase
        $alias_2 = "apt.drooptroop" ascii wide nocase
        $alias_3 = "loader.drooptroop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DROOPTROOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Drooptroop tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drooptroop"
        date = "2026-10-16"
    strings:
        $attrib_str = "drooptroop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dropware (Trojan_Dropper)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dropware
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DROPWARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dropware (Trojan_Dropper)"
        category = "Trojan_Dropper"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dropware"
        date = "2026-10-16"
    strings:
        $fam_name = "dropware" ascii wide nocase
        $alias_1 = "trojandropper:win32/dropware" ascii wide nocase
        $alias_2 = "trojan:win32/dropware" ascii wide nocase
        $alias_3 = "trojan.dropware" ascii wide nocase
        $alias_4 = "win32/dropware" ascii wide nocase
        $alias_5 = "trojandropper:win32/dropware.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DROPWARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dropware tradecraft"
        category = "Trojan_Dropper"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dropware"
        date = "2026-10-16"
    strings:
        $attrib_str = "dropware" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Drowor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/drowor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DROWOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Drowor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drowor"
        date = "2026-10-16"
    strings:
        $fam_name = "drowor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DROWOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Drowor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/drowor"
        date = "2026-10-16"
    strings:
        $attrib_str = "drowor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dsbot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dsbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DSBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dsbot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dsbot"
        date = "2026-10-16"
    strings:
        $fam_name = "dsbot" ascii wide nocase
        $alias_1 = "trojan.dsbot" ascii wide nocase
        $alias_2 = "botnet.dsbot" ascii wide nocase
        $alias_3 = "win32/dsbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DSBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dsbot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dsbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "dsbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dubfot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dubfot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DUBFOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dubfot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dubfot"
        date = "2026-10-16"
    strings:
        $fam_name = "dubfot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DUBFOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dubfot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dubfot"
        date = "2026-10-16"
    strings:
        $attrib_str = "dubfot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Duduunion (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/duduunion
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DUDUUNION_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Duduunion (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/duduunion"
        date = "2026-10-16"
    strings:
        $fam_name = "duduunion" ascii wide nocase
        $alias_1 = "trojan.duduunion" ascii wide nocase
        $alias_2 = "downloader.duduunion" ascii wide nocase
        $alias_3 = "win32/duduunion" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DUDUUNION_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Duduunion tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/duduunion"
        date = "2026-10-16"
    strings:
        $attrib_str = "duduunion" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dumpy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dumpy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DUMPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dumpy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dumpy"
        date = "2026-10-16"
    strings:
        $fam_name = "dumpy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DUMPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dumpy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dumpy"
        date = "2026-10-16"
    strings:
        $attrib_str = "dumpy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dunco (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dunco
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DUNCO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dunco (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dunco"
        date = "2026-10-16"
    strings:
        $fam_name = "dunco" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DUNCO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dunco tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dunco"
        date = "2026-10-16"
    strings:
        $attrib_str = "dunco" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dungcoi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dungcoi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DUNGCOI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dungcoi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dungcoi"
        date = "2026-10-16"
    strings:
        $fam_name = "dungcoi" ascii wide nocase
        $alias_1 = "trojan.dungcoi" ascii wide nocase
        $alias_2 = "downloader.dungcoi" ascii wide nocase
        $alias_3 = "win32/dungcoi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DUNGCOI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dungcoi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dungcoi"
        date = "2026-10-16"
    strings:
        $attrib_str = "dungcoi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dunik (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dunik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DUNIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dunik (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dunik"
        date = "2026-10-16"
    strings:
        $fam_name = "dunik" ascii wide nocase
        $alias_1 = "trojan.dunik" ascii wide nocase
        $alias_2 = "downloader.dunik" ascii wide nocase
        $alias_3 = "win32/dunik" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DUNIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dunik tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dunik"
        date = "2026-10-16"
    strings:
        $attrib_str = "dunik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Duon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/duon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DUON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Duon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/duon"
        date = "2026-10-16"
    strings:
        $fam_name = "duon" ascii wide nocase
        $alias_1 = "trojan.duon" ascii wide nocase
        $alias_2 = "downloader.duon" ascii wide nocase
        $alias_3 = "win32/duon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DUON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Duon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/duon"
        date = "2026-10-16"
    strings:
        $attrib_str = "duon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dupate (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dupate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DUPATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dupate (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dupate"
        date = "2026-10-16"
    strings:
        $fam_name = "dupate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DUPATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dupate tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dupate"
        date = "2026-10-16"
    strings:
        $attrib_str = "dupate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Duphead (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/duphead
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DUPHEAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Duphead (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/duphead"
        date = "2026-10-16"
    strings:
        $fam_name = "duphead" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DUPHEAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Duphead tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/duphead"
        date = "2026-10-16"
    strings:
        $attrib_str = "duphead" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dyamar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dyamar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DYAMAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dyamar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dyamar"
        date = "2026-10-16"
    strings:
        $fam_name = "dyamar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DYAMAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dyamar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dyamar"
        date = "2026-10-16"
    strings:
        $attrib_str = "dyamar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dycler (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dycler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DYCLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dycler (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dycler"
        date = "2026-10-16"
    strings:
        $fam_name = "dycler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DYCLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dycler tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dycler"
        date = "2026-10-16"
    strings:
        $attrib_str = "dycler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Dyloader (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dyloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DYLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dyloader (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dyloader"
        date = "2026-10-16"
    strings:
        $fam_name = "dyloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DYLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dyloader tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dyloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "dyloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dynamer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dynamer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DYNAMER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dynamer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dynamer"
        date = "2026-10-16"
    strings:
        $fam_name = "dynamer" ascii wide nocase
        $alias_1 = "trojan:win32/dynamer" ascii wide nocase
        $alias_2 = "trojan:win32/dynamer!ac" ascii wide nocase
        $alias_3 = "trojan:win32/dynamer!rfn" ascii wide nocase
        $alias_4 = "trojan.win32.dynamer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DYNAMER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dynamer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dynamer"
        date = "2026-10-16"
    strings:
        $attrib_str = "dynamer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Dzan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/dzan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DZAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dzan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dzan"
        date = "2026-10-16"
    strings:
        $fam_name = "dzan" ascii wide nocase
        $alias_1 = "trojan.dzan" ascii wide nocase
        $alias_2 = "downloader.dzan" ascii wide nocase
        $alias_3 = "win32/dzan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DZAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dzan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/dzan"
        date = "2026-10-16"
    strings:
        $attrib_str = "dzan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for E13044Af (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/e13044af
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_E13044AF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for E13044Af (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/e13044af"
        date = "2026-10-16"
    strings:
        $fam_name = "e13044af" ascii wide nocase
        $alias_1 = "trojan.e13044af" ascii wide nocase
        $alias_2 = "win32/trojan.obfuscated" ascii wide nocase
        $alias_3 = "suspicious.hash" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_E13044AF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for E13044Af tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/e13044af"
        date = "2026-10-16"
    strings:
        $attrib_str = "e13044af" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for E2F3F4D (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/e2f3f4d
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_E2F3F4D_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for E2F3F4D (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/e2f3f4d"
        date = "2026-10-16"
    strings:
        $fam_name = "e2f3f4d" ascii wide nocase
        $alias_1 = "trojan.hash" ascii wide nocase
        $alias_2 = "malware.e2f3f4d" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_E2F3F4D_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for E2F3F4D tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/e2f3f4d"
        date = "2026-10-16"
    strings:
        $attrib_str = "e2f3f4d" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Easyspeedcheck (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/easyspeedcheck
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EASYSPEEDCHECK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Easyspeedcheck (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/easyspeedcheck"
        date = "2026-10-16"
    strings:
        $fam_name = "easyspeedcheck" ascii wide nocase
        $alias_1 = "adware.easyspeedcheck" ascii wide nocase
        $alias_2 = "pup.easyspeedcheck" ascii wide nocase
        $alias_3 = "browsermodifier:win32/easyspeedcheck" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EASYSPEEDCHECK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Easyspeedcheck tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/easyspeedcheck"
        date = "2026-10-16"
    strings:
        $attrib_str = "easyspeedcheck" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Eb149B (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eb149b
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EB149B_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eb149B (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eb149b"
        date = "2026-10-16"
    strings:
        $fam_name = "eb149b" ascii wide nocase
        $alias_1 = "generic.eb149b" ascii wide nocase
        $alias_2 = "trojan.generic" ascii wide nocase
        $alias_3 = "suspicious.eb149b" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EB149B_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eb149B tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eb149b"
        date = "2026-10-16"
    strings:
        $attrib_str = "eb149b" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Edeals (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/edeals
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EDEALS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Edeals (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/edeals"
        date = "2026-10-16"
    strings:
        $fam_name = "edeals" ascii wide nocase
        $alias_1 = "adware.edeals" ascii wide nocase
        $alias_2 = "pup.edeals" ascii wide nocase
        $alias_3 = "browsermodifier:win32/edeals" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EDEALS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Edeals tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/edeals"
        date = "2026-10-16"
    strings:
        $attrib_str = "edeals" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Effbee (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/effbee
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EFFBEE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Effbee (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/effbee"
        date = "2026-10-16"
    strings:
        $fam_name = "effbee" ascii wide nocase
        $alias_1 = "trojan.effbee" ascii wide nocase
        $alias_2 = "downloader.effbee" ascii wide nocase
        $alias_3 = "win32/effbee" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EFFBEE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Effbee tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/effbee"
        date = "2026-10-16"
    strings:
        $attrib_str = "effbee" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Eggnog (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eggnog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EGGNOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eggnog (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eggnog"
        date = "2026-10-16"
    strings:
        $fam_name = "eggnog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EGGNOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eggnog tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eggnog"
        date = "2026-10-16"
    strings:
        $attrib_str = "eggnog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Egroupdial (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/egroupdial
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EGROUPDIAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Egroupdial (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/egroupdial"
        date = "2026-10-16"
    strings:
        $fam_name = "egroupdial" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EGROUPDIAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Egroupdial tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/egroupdial"
        date = "2026-10-16"
    strings:
        $attrib_str = "egroupdial" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ei0Frdaui (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ei0frdaui
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EI0FRDAUI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ei0Frdaui (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ei0frdaui"
        date = "2026-10-16"
    strings:
        $fam_name = "ei0frdaui" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EI0FRDAUI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ei0Frdaui tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ei0frdaui"
        date = "2026-10-16"
    strings:
        $attrib_str = "ei0frdaui" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Eicardemo (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eicardemo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EICARDEMO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eicardemo (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eicardemo"
        date = "2026-10-16"
    strings:
        $fam_name = "eicardemo" ascii wide nocase
        $alias_1 = "eicar_test_file" ascii wide nocase
        $alias_2 = "test-file.eicar" ascii wide nocase
        $alias_3 = "not-a-virus:eicar-test-signature" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EICARDEMO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eicardemo tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eicardemo"
        date = "2026-10-16"
    strings:
        $attrib_str = "eicardemo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Eitu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eitu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EITU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eitu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eitu"
        date = "2026-10-16"
    strings:
        $fam_name = "eitu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EITU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eitu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eitu"
        date = "2026-10-16"
    strings:
        $attrib_str = "eitu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ekidoa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ekidoa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EKIDOA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ekidoa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ekidoa"
        date = "2026-10-16"
    strings:
        $fam_name = "ekidoa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EKIDOA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ekidoa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ekidoa"
        date = "2026-10-16"
    strings:
        $attrib_str = "ekidoa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ekisoli (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ekisoli
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EKISOLI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ekisoli (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ekisoli"
        date = "2026-10-16"
    strings:
        $fam_name = "ekisoli" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EKISOLI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ekisoli tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ekisoli"
        date = "2026-10-16"
    strings:
        $attrib_str = "ekisoli" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ekstak (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ekstak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EKSTAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ekstak (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ekstak"
        date = "2026-10-16"
    strings:
        $fam_name = "ekstak" ascii wide nocase
        $alias_1 = "trojan.win32.ekstak" ascii wide nocase
        $alias_2 = "trojan:win32/ekstak" ascii wide nocase
        $alias_3 = "worm:win32/ekstak" ascii wide nocase
        $alias_4 = "win32/ekstak.a" ascii wide nocase
        $alias_5 = "backdoor.ekstak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EKSTAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ekstak tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ekstak"
        date = "2026-10-16"
    strings:
        $attrib_str = "ekstak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Elemental (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/elemental
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ELEMENTAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Elemental (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elemental"
        date = "2026-10-16"
    strings:
        $fam_name = "elemental" ascii wide nocase
        $alias_1 = "pup.elemental" ascii wide nocase
        $alias_2 = "trojan:win32/elemental" ascii wide nocase
        $alias_3 = "win32/elemental" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ELEMENTAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Elemental tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elemental"
        date = "2026-10-16"
    strings:
        $attrib_str = "elemental" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Elevate (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/elevate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ELEVATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Elevate (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elevate"
        date = "2026-10-16"
    strings:
        $fam_name = "elevate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ELEVATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Elevate tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elevate"
        date = "2026-10-16"
    strings:
        $attrib_str = "elevate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Elex (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/elex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ELEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Elex (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elex"
        date = "2026-10-16"
    strings:
        $fam_name = "elex" ascii wide nocase
        $alias_1 = "browsermodifier:win32/elex" ascii wide nocase
        $alias_2 = "adware:win32/elex" ascii wide nocase
        $alias_3 = "trojan.elex" ascii wide nocase
        $alias_4 = "win32/elex" ascii wide nocase
        $alias_5 = "fireball malware" ascii wide nocase
        $alias_6 = "yeabests browser hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ELEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Elex tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elex"
        date = "2026-10-16"
    strings:
        $attrib_str = "elex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Elite (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/elite
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ELITE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Elite (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elite"
        date = "2026-10-16"
    strings:
        $fam_name = "elite" ascii wide nocase
        $alias_1 = "ransomware.elite" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.elite" ascii wide nocase
        $alias_3 = "filecoder.elite" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ELITE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Elite tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elite"
        date = "2026-10-16"
    strings:
        $attrib_str = "elite" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Elitekeylogger (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/elitekeylogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ELITEKEYLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Elitekeylogger (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elitekeylogger"
        date = "2026-10-16"
    strings:
        $fam_name = "elitekeylogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ELITEKEYLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Elitekeylogger tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elitekeylogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "elitekeylogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Elzob (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/elzob
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ELZOB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Elzob (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elzob"
        date = "2026-10-16"
    strings:
        $fam_name = "elzob" ascii wide nocase
        $alias_1 = "ransom:win32/elzob" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.elzob" ascii wide nocase
        $alias_3 = "win32/elzob" ascii wide nocase
        $alias_4 = "ransom.elzob" ascii wide nocase
        $alias_5 = "ransom:win32/elzob.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ELZOB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Elzob tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/elzob"
        date = "2026-10-16"
    strings:
        $attrib_str = "elzob" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Emarketing (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/emarketing
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EMARKETING_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Emarketing (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emarketing"
        date = "2026-10-16"
    strings:
        $fam_name = "emarketing" ascii wide nocase
        $alias_1 = "adware.emarketing" ascii wide nocase
        $alias_2 = "pup.emarketing" ascii wide nocase
        $alias_3 = "spyware.marketing" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EMARKETING_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Emarketing tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emarketing"
        date = "2026-10-16"
    strings:
        $attrib_str = "emarketing" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Emathi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/emathi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EMATHI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Emathi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emathi"
        date = "2026-10-16"
    strings:
        $fam_name = "emathi" ascii wide nocase
        $alias_1 = "trojan.emathi" ascii wide nocase
        $alias_2 = "downloader.emathi" ascii wide nocase
        $alias_3 = "win32/emathi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EMATHI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Emathi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emathi"
        date = "2026-10-16"
    strings:
        $attrib_str = "emathi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Emelent (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/emelent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EMELENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Emelent (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emelent"
        date = "2026-10-16"
    strings:
        $fam_name = "emelent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EMELENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Emelent tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emelent"
        date = "2026-10-16"
    strings:
        $attrib_str = "emelent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Emgfamt7Gjgi (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/emgfamt7gjgi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EMGFAMT7GJGI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Emgfamt7Gjgi (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emgfamt7gjgi"
        date = "2026-10-16"
    strings:
        $fam_name = "emgfamt7gjgi" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.emgfamt7gjgi" ascii wide nocase
        $alias_3 = "heur.emgfamt7gjgi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EMGFAMT7GJGI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Emgfamt7Gjgi tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emgfamt7gjgi"
        date = "2026-10-16"
    strings:
        $attrib_str = "emgfamt7gjgi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Emmfaeuirscb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/emmfaeuirscb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EMMFAEUIRSCB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Emmfaeuirscb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emmfaeuirscb"
        date = "2026-10-16"
    strings:
        $fam_name = "emmfaeuirscb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EMMFAEUIRSCB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Emmfaeuirscb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emmfaeuirscb"
        date = "2026-10-16"
    strings:
        $attrib_str = "emmfaeuirscb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Emogen (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/emogen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EMOGEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Emogen (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emogen"
        date = "2026-10-16"
    strings:
        $fam_name = "emogen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EMOGEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Emogen tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emogen"
        date = "2026-10-16"
    strings:
        $attrib_str = "emogen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Emotet (Loader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/emotet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EMOTET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Emotet (Loader)"
        category = "Loader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emotet"
        date = "2026-10-16"
    strings:
        $fam_name = "emotet" ascii wide nocase
        $alias_1 = "emotet" ascii wide nocase
        $alias_2 = "geodo" ascii wide nocase
        $alias_3 = "heodo" ascii wide nocase
        $alias_4 = "ta542" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EMOTET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Emotet tradecraft"
        category = "Loader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emotet"
        date = "2026-10-16"
    strings:
        $attrib_str = "emotet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Emotetn (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/emotetn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EMOTETN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Emotetn (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emotetn"
        date = "2026-10-16"
    strings:
        $fam_name = "emotetn" ascii wide nocase
        $alias_1 = "trojan.emotetn" ascii wide nocase
        $alias_2 = "botnet.emotet" ascii wide nocase
        $alias_3 = "win32/emotet" ascii wide nocase
        $alias_4 = "heur.bzc.ztr.boxter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EMOTETN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Emotetn tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emotetn"
        date = "2026-10-16"
    strings:
        $attrib_str = "emotetn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Emudbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/emudbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EMUDBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Emudbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emudbot"
        date = "2026-10-16"
    strings:
        $fam_name = "emudbot" ascii wide nocase
        $alias_1 = "botnet.emudbot" ascii wide nocase
        $alias_2 = "trojan.emudbot" ascii wide nocase
        $alias_3 = "win32/emudbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EMUDBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Emudbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/emudbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "emudbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Encryptpe (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/encryptpe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ENCRYPTPE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Encryptpe (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/encryptpe"
        date = "2026-10-16"
    strings:
        $fam_name = "encryptpe" ascii wide nocase
        $alias_1 = "packed.encryptpe" ascii wide nocase
        $alias_2 = "suspicious.packer" ascii wide nocase
        $alias_3 = "win32/packed.encryptpe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ENCRYPTPE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Encryptpe tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/encryptpe"
        date = "2026-10-16"
    strings:
        $attrib_str = "encryptpe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Enestedel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/enestedel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ENESTEDEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Enestedel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enestedel"
        date = "2026-10-16"
    strings:
        $fam_name = "enestedel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ENESTEDEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Enestedel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enestedel"
        date = "2026-10-16"
    strings:
        $attrib_str = "enestedel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Enfal (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/enfal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ENFAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Enfal (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enfal"
        date = "2026-10-16"
    strings:
        $fam_name = "enfal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ENFAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Enfal tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enfal"
        date = "2026-10-16"
    strings:
        $attrib_str = "enfal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Enigma (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/enigma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ENIGMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Enigma (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enigma"
        date = "2026-10-16"
    strings:
        $fam_name = "enigma" ascii wide nocase
        $alias_1 = "ransom:win32/enigma" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.enigma" ascii wide nocase
        $alias_3 = "win32/enigma" ascii wide nocase
        $alias_4 = "enigma ransomware" ascii wide nocase
        $alias_5 = "ransom.enigma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ENIGMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Enigma tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enigma"
        date = "2026-10-16"
    strings:
        $attrib_str = "enigma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Enigmaprotector (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/enigmaprotector
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ENIGMAPROTECTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Enigmaprotector (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enigmaprotector"
        date = "2026-10-16"
    strings:
        $fam_name = "enigmaprotector" ascii wide nocase
        $alias_1 = "packer:win32/enigmaprotector" ascii wide nocase
        $alias_2 = "trojan:win32/enigmaprotector" ascii wide nocase
        $alias_3 = "packer.enigma" ascii wide nocase
        $alias_4 = "win32/enigmaprotector" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ENIGMAPROTECTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Enigmaprotector tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enigmaprotector"
        date = "2026-10-16"
    strings:
        $attrib_str = "enigmaprotector" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Enistery (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/enistery
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ENISTERY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Enistery (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enistery"
        date = "2026-10-16"
    strings:
        $fam_name = "enistery" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ENISTERY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Enistery tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enistery"
        date = "2026-10-16"
    strings:
        $attrib_str = "enistery" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Enosch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/enosch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ENOSCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Enosch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enosch"
        date = "2026-10-16"
    strings:
        $fam_name = "enosch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ENOSCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Enosch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/enosch"
        date = "2026-10-16"
    strings:
        $attrib_str = "enosch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Eorezo (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eorezo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EOREZO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eorezo (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eorezo"
        date = "2026-10-16"
    strings:
        $fam_name = "eorezo" ascii wide nocase
        $alias_1 = "adware:win32/eorezo" ascii wide nocase
        $alias_2 = "pua:win32/eorezo" ascii wide nocase
        $alias_3 = "adware.eorezo" ascii wide nocase
        $alias_4 = "win32/eorezo" ascii wide nocase
        $alias_5 = "tuto4pc.eorezo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EOREZO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eorezo tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eorezo"
        date = "2026-10-16"
    strings:
        $attrib_str = "eorezo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Epack (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/epack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EPACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Epack (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/epack"
        date = "2026-10-16"
    strings:
        $fam_name = "epack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EPACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Epack tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/epack"
        date = "2026-10-16"
    strings:
        $attrib_str = "epack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Epicscale (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/epicscale
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EPICSCALE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Epicscale (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/epicscale"
        date = "2026-10-16"
    strings:
        $fam_name = "epicscale" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EPICSCALE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Epicscale tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/epicscale"
        date = "2026-10-16"
    strings:
        $attrib_str = "epicscale" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Eqtonex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eqtonex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EQTONEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eqtonex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eqtonex"
        date = "2026-10-16"
    strings:
        $fam_name = "eqtonex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EQTONEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eqtonex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eqtonex"
        date = "2026-10-16"
    strings:
        $attrib_str = "eqtonex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Equationdrug (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/equationdrug
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EQUATIONDRUG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Equationdrug (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/equationdrug"
        date = "2026-10-16"
    strings:
        $fam_name = "equationdrug" ascii wide nocase
        $alias_1 = "equationdrug" ascii wide nocase
        $alias_2 = "trojan.equationdrug" ascii wide nocase
        $alias_3 = "win32/equationdrug" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EQUATIONDRUG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Equationdrug tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/equationdrug"
        date = "2026-10-16"
    strings:
        $attrib_str = "equationdrug" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Erazer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/erazer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ERAZER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Erazer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/erazer"
        date = "2026-10-16"
    strings:
        $fam_name = "erazer" ascii wide nocase
        $alias_1 = "trojan:win32/erazer" ascii wide nocase
        $alias_2 = "backdoor.erazer" ascii wide nocase
        $alias_3 = "win32.erazer.rat" ascii wide nocase
        $alias_4 = "trojan.killfiles.erazer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ERAZER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Erazer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/erazer"
        date = "2026-10-16"
    strings:
        $attrib_str = "erazer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Erazer_Lite (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/erazer_lite
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ERAZER_LITE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Erazer_Lite (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/erazer_lite"
        date = "2026-10-16"
    strings:
        $fam_name = "erazer_lite" ascii wide nocase
        $alias_1 = "erazer lite trojan" ascii wide nocase
        $alias_2 = "win32/erazerlite" ascii wide nocase
        $alias_3 = "backdoor.win32.erazerlite" ascii wide nocase
        $alias_4 = "trojan:win32/erazer.b" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ERAZER_LITE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Erazer_Lite tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/erazer_lite"
        date = "2026-10-16"
    strings:
        $attrib_str = "erazer_lite" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Erbon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/erbon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ERBON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Erbon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/erbon"
        date = "2026-10-16"
    strings:
        $fam_name = "erbon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ERBON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Erbon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/erbon"
        date = "2026-10-16"
    strings:
        $attrib_str = "erbon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Eroyee (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eroyee
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EROYEE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eroyee (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eroyee"
        date = "2026-10-16"
    strings:
        $fam_name = "eroyee" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EROYEE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eroyee tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eroyee"
        date = "2026-10-16"
    strings:
        $attrib_str = "eroyee" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Esaprof (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/esaprof
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ESAPROF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Esaprof (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/esaprof"
        date = "2026-10-16"
    strings:
        $fam_name = "esaprof" ascii wide nocase
        $alias_1 = "adware.esaprof" ascii wide nocase
        $alias_2 = "pup.esaprof" ascii wide nocase
        $alias_3 = "browsermodifier.esaprof" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ESAPROF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Esaprof tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/esaprof"
        date = "2026-10-16"
    strings:
        $attrib_str = "esaprof" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Esendi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/esendi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ESENDI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Esendi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/esendi"
        date = "2026-10-16"
    strings:
        $fam_name = "esendi" ascii wide nocase
        $alias_1 = "trojan.esendi" ascii wide nocase
        $alias_2 = "downloader.esendi" ascii wide nocase
        $alias_3 = "win32/esendi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ESENDI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Esendi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/esendi"
        date = "2026-10-16"
    strings:
        $attrib_str = "esendi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Esfury (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/esfury
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ESFURY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Esfury (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/esfury"
        date = "2026-10-16"
    strings:
        $fam_name = "esfury" ascii wide nocase
        $alias_1 = "trojan.pws.esfury" ascii wide nocase
        $alias_2 = "spyware.esfury" ascii wide nocase
        $alias_3 = "win32/esfury" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ESFURY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Esfury tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/esfury"
        date = "2026-10-16"
    strings:
        $attrib_str = "esfury" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Eskimo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eskimo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ESKIMO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eskimo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eskimo"
        date = "2026-10-16"
    strings:
        $fam_name = "eskimo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ESKIMO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eskimo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eskimo"
        date = "2026-10-16"
    strings:
        $attrib_str = "eskimo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Esprot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/esprot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ESPROT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Esprot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/esprot"
        date = "2026-10-16"
    strings:
        $fam_name = "esprot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ESPROT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Esprot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/esprot"
        date = "2026-10-16"
    strings:
        $attrib_str = "esprot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Estapa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/estapa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ESTAPA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Estapa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/estapa"
        date = "2026-10-16"
    strings:
        $fam_name = "estapa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ESTAPA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Estapa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/estapa"
        date = "2026-10-16"
    strings:
        $attrib_str = "estapa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Estrella (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/estrella
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ESTRELLA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Estrella (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/estrella"
        date = "2026-10-16"
    strings:
        $fam_name = "estrella" ascii wide nocase
        $alias_1 = "trojan.estrella" ascii wide nocase
        $alias_2 = "downloader.estrella" ascii wide nocase
        $alias_3 = "win32/estrella" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ESTRELLA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Estrella tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/estrella"
        date = "2026-10-16"
    strings:
        $attrib_str = "estrella" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Eszjuxuan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eszjuxuan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ESZJUXUAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eszjuxuan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eszjuxuan"
        date = "2026-10-16"
    strings:
        $fam_name = "eszjuxuan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ESZJUXUAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eszjuxuan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eszjuxuan"
        date = "2026-10-16"
    strings:
        $attrib_str = "eszjuxuan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Etap (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/etap
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ETAP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Etap (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/etap"
        date = "2026-10-16"
    strings:
        $fam_name = "etap" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ETAP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Etap tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/etap"
        date = "2026-10-16"
    strings:
        $attrib_str = "etap" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Eventmonitor (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eventmonitor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EVENTMONITOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eventmonitor (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eventmonitor"
        date = "2026-10-16"
    strings:
        $fam_name = "eventmonitor" ascii wide nocase
        $alias_1 = "riskware.eventmonitor" ascii wide nocase
        $alias_2 = "hacktool.monitor" ascii wide nocase
        $alias_3 = "spyware.eventlogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EVENTMONITOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eventmonitor tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eventmonitor"
        date = "2026-10-16"
    strings:
        $attrib_str = "eventmonitor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Evillocker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/evillocker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EVILLOCKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Evillocker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/evillocker"
        date = "2026-10-16"
    strings:
        $fam_name = "evillocker" ascii wide nocase
        $alias_1 = "ransom.evillocker" ascii wide nocase
        $alias_2 = "win32/filecoder.evil" ascii wide nocase
        $alias_3 = "trojan-ransom.win32.evillocker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EVILLOCKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Evillocker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/evillocker"
        date = "2026-10-16"
    strings:
        $attrib_str = "evillocker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Evital (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/evital
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EVITAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Evital (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/evital"
        date = "2026-10-16"
    strings:
        $fam_name = "evital" ascii wide nocase
        $alias_1 = "trojan:win32/evital" ascii wide nocase
        $alias_2 = "trojan.win32.evital" ascii wide nocase
        $alias_3 = "win32/evital" ascii wide nocase
        $alias_4 = "trojan:win32/evital!rfn" ascii wide nocase
        $alias_5 = "evital stager" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EVITAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Evital tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/evital"
        date = "2026-10-16"
    strings:
        $attrib_str = "evital" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Evrial (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/evrial
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EVRIAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Evrial (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/evrial"
        date = "2026-10-16"
    strings:
        $fam_name = "evrial" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EVRIAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Evrial tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/evrial"
        date = "2026-10-16"
    strings:
        $attrib_str = "evrial" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Exchanger (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/exchanger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXCHANGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Exchanger (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exchanger"
        date = "2026-10-16"
    strings:
        $fam_name = "exchanger" ascii wide nocase
        $alias_1 = "trojan.exchanger" ascii wide nocase
        $alias_2 = "downloader.exchanger" ascii wide nocase
        $alias_3 = "win32/exchanger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXCHANGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Exchanger tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exchanger"
        date = "2026-10-16"
    strings:
        $attrib_str = "exchanger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Excrevie (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/excrevie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXCREVIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Excrevie (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/excrevie"
        date = "2026-10-16"
    strings:
        $fam_name = "excrevie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXCREVIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Excrevie tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/excrevie"
        date = "2026-10-16"
    strings:
        $attrib_str = "excrevie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Exdek (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/exdek
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXDEK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Exdek (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exdek"
        date = "2026-10-16"
    strings:
        $fam_name = "exdek" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXDEK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Exdek tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exdek"
        date = "2026-10-16"
    strings:
        $attrib_str = "exdek" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Exeaqtor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/exeaqtor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXEAQTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Exeaqtor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exeaqtor"
        date = "2026-10-16"
    strings:
        $fam_name = "exeaqtor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXEAQTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Exeaqtor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exeaqtor"
        date = "2026-10-16"
    strings:
        $attrib_str = "exeaqtor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Exebinder (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/exebinder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXEBINDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Exebinder (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exebinder"
        date = "2026-10-16"
    strings:
        $fam_name = "exebinder" ascii wide nocase
        $alias_1 = "hacktool:win32/exebinder" ascii wide nocase
        $alias_2 = "trojan.binder" ascii wide nocase
        $alias_3 = "win32/joiner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXEBINDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Exebinder tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exebinder"
        date = "2026-10-16"
    strings:
        $attrib_str = "exebinder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Exent (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/exent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Exent (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exent"
        date = "2026-10-16"
    strings:
        $fam_name = "exent" ascii wide nocase
        $alias_1 = "adware.exent" ascii wide nocase
        $alias_2 = "pup.exent" ascii wide nocase
        $alias_3 = "win32/adware.gamingplatform" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Exent tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exent"
        date = "2026-10-16"
    strings:
        $attrib_str = "exent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Exescript (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/exescript
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXESCRIPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Exescript (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exescript"
        date = "2026-10-16"
    strings:
        $fam_name = "exescript" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXESCRIPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Exescript tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exescript"
        date = "2026-10-16"
    strings:
        $attrib_str = "exescript" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Exfriendalert (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/exfriendalert
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXFRIENDALERT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Exfriendalert (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exfriendalert"
        date = "2026-10-16"
    strings:
        $fam_name = "exfriendalert" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXFRIENDALERT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Exfriendalert tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exfriendalert"
        date = "2026-10-16"
    strings:
        $attrib_str = "exfriendalert" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Exksws (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/exksws
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXKSWS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Exksws (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exksws"
        date = "2026-10-16"
    strings:
        $fam_name = "exksws" ascii wide nocase
        $alias_1 = "trojan.exksws" ascii wide nocase
        $alias_2 = "downloader.exksws" ascii wide nocase
        $alias_3 = "win32/exksws" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXKSWS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Exksws tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exksws"
        date = "2026-10-16"
    strings:
        $attrib_str = "exksws" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Expiro (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/expiro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXPIRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Expiro (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/expiro"
        date = "2026-10-16"
    strings:
        $fam_name = "expiro" ascii wide nocase
        $alias_1 = "virus:win32/expiro" ascii wide nocase
        $alias_2 = "virus:win64/expiro" ascii wide nocase
        $alias_3 = "w32.expiro" ascii wide nocase
        $alias_4 = "w64.expiro" ascii wide nocase
        $alias_5 = "xpiro" ascii wide nocase
        $alias_6 = "win32/expiro.gen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXPIRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Expiro tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/expiro"
        date = "2026-10-16"
    strings:
        $attrib_str = "expiro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Exploder (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/exploder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXPLODER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Exploder (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exploder"
        date = "2026-10-16"
    strings:
        $fam_name = "exploder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXPLODER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Exploder tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exploder"
        date = "2026-10-16"
    strings:
        $attrib_str = "exploder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Explorerhijack (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/explorerhijack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXPLORERHIJACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Explorerhijack (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/explorerhijack"
        date = "2026-10-16"
    strings:
        $fam_name = "explorerhijack" ascii wide nocase
        $alias_1 = "behavior:win32/explorerhijack" ascii wide nocase
        $alias_2 = "trojan:win32/explorerhijack" ascii wide nocase
        $alias_3 = "hacktool:win32/explorerhijack" ascii wide nocase
        $alias_4 = "processhijack.explorer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXPLORERHIJACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Explorerhijack tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/explorerhijack"
        date = "2026-10-16"
    strings:
        $attrib_str = "explorerhijack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Expressdownloader (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/expressdownloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXPRESSDOWNLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Expressdownloader (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/expressdownloader"
        date = "2026-10-16"
    strings:
        $fam_name = "expressdownloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXPRESSDOWNLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Expressdownloader tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/expressdownloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "expressdownloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Expstart (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/expstart
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXPSTART_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Expstart (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/expstart"
        date = "2026-10-16"
    strings:
        $fam_name = "expstart" ascii wide nocase
        $alias_1 = "exploit.js.agent" ascii wide nocase
        $alias_2 = "trojan.expstart" ascii wide nocase
        $alias_3 = "exploit-kit.generic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXPSTART_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Expstart tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/expstart"
        date = "2026-10-16"
    strings:
        $attrib_str = "expstart" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Extcrome (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/extcrome
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXTCROME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Extcrome (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/extcrome"
        date = "2026-10-16"
    strings:
        $fam_name = "extcrome" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXTCROME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Extcrome tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/extcrome"
        date = "2026-10-16"
    strings:
        $attrib_str = "extcrome" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Extenbro (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/extenbro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXTENBRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Extenbro (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/extenbro"
        date = "2026-10-16"
    strings:
        $fam_name = "extenbro" ascii wide nocase
        $alias_1 = "trojan:win32/extenbro" ascii wide nocase
        $alias_2 = "trojan:js/extenbro!mtb" ascii wide nocase
        $alias_3 = "trojandownloader:win32/extenbro.a" ascii wide nocase
        $alias_4 = "browsermodifier:win32/extenbro" ascii wide nocase
        $alias_5 = "adware.extenbro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXTENBRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Extenbro tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/extenbro"
        date = "2026-10-16"
    strings:
        $attrib_str = "extenbro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Extinstaller (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/extinstaller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXTINSTALLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Extinstaller (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/extinstaller"
        date = "2026-10-16"
    strings:
        $fam_name = "extinstaller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXTINSTALLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Extinstaller tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/extinstaller"
        date = "2026-10-16"
    strings:
        $attrib_str = "extinstaller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Exxroute (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/exxroute
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EXXROUTE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Exxroute (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exxroute"
        date = "2026-10-16"
    strings:
        $fam_name = "exxroute" ascii wide nocase
        $alias_1 = "trojan.exxroute" ascii wide nocase
        $alias_2 = "dnschanger.exxroute" ascii wide nocase
        $alias_3 = "win32/exxroute" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EXXROUTE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Exxroute tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/exxroute"
        date = "2026-10-16"
    strings:
        $attrib_str = "exxroute" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Eyestye (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eyestye
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EYESTYE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eyestye (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eyestye"
        date = "2026-10-16"
    strings:
        $fam_name = "eyestye" ascii wide nocase
        $alias_1 = "pws:win32/eyestye" ascii wide nocase
        $alias_2 = "trojan:win32/eyestye" ascii wide nocase
        $alias_3 = "worm:win32/eyestye" ascii wide nocase
        $alias_4 = "win32/eyestye" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EYESTYE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eyestye tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eyestye"
        date = "2026-10-16"
    strings:
        $attrib_str = "eyestye" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Eyooun (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eyooun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EYOOUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eyooun (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eyooun"
        date = "2026-10-16"
    strings:
        $fam_name = "eyooun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EYOOUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eyooun tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eyooun"
        date = "2026-10-16"
    strings:
        $attrib_str = "eyooun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Eziriznetreactor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/eziriznetreactor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EZIRIZNETREACTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Eziriznetreactor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eziriznetreactor"
        date = "2026-10-16"
    strings:
        $fam_name = "eziriznetreactor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EZIRIZNETREACTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Eziriznetreactor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/eziriznetreactor"
        date = "2026-10-16"
    strings:
        $attrib_str = "eziriznetreactor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ezoons (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ezoons
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EZOONS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ezoons (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ezoons"
        date = "2026-10-16"
    strings:
        $fam_name = "ezoons" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EZOONS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ezoons tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ezoons"
        date = "2026-10-16"
    strings:
        $attrib_str = "ezoons" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ezsearch (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ezsearch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EZSEARCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ezsearch (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ezsearch"
        date = "2026-10-16"
    strings:
        $fam_name = "ezsearch" ascii wide nocase
        $alias_1 = "hijacker.ezsearch" ascii wide nocase
        $alias_2 = "adware.ezsearch" ascii wide nocase
        $alias_3 = "browsermodifier:win32/ezsearch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EZSEARCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ezsearch tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ezsearch"
        date = "2026-10-16"
    strings:
        $attrib_str = "ezsearch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ezsoftwareupdater (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ezsoftwareupdater
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EZSOFTWAREUPDATER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ezsoftwareupdater (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ezsoftwareupdater"
        date = "2026-10-16"
    strings:
        $fam_name = "ezsoftwareupdater" ascii wide nocase
        $alias_1 = "pup.optional.ezsoftwareupdater" ascii wide nocase
        $alias_2 = "adware.ezsoftwareupdater" ascii wide nocase
        $alias_3 = "win32/pup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EZSOFTWAREUPDATER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ezsoftwareupdater tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ezsoftwareupdater"
        date = "2026-10-16"
    strings:
        $attrib_str = "ezsoftwareupdater" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ezula (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ezula
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_EZULA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ezula (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ezula"
        date = "2026-10-16"
    strings:
        $fam_name = "ezula" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_EZULA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ezula tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ezula"
        date = "2026-10-16"
    strings:
        $attrib_str = "ezula" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Facemoi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/facemoi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FACEMOI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Facemoi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/facemoi"
        date = "2026-10-16"
    strings:
        $fam_name = "facemoi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FACEMOI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Facemoi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/facemoi"
        date = "2026-10-16"
    strings:
        $attrib_str = "facemoi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Facido (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/facido
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FACIDO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Facido (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/facido"
        date = "2026-10-16"
    strings:
        $fam_name = "facido" ascii wide nocase
        $alias_1 = "trojan:win32/facido" ascii wide nocase
        $alias_2 = "trojandropper.facido" ascii wide nocase
        $alias_3 = "dropper.facido" ascii wide nocase
        $alias_4 = "win32/facido" ascii wide nocase
        $alias_5 = "trojan:win32/facido!rfn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FACIDO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Facido tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/facido"
        date = "2026-10-16"
    strings:
        $attrib_str = "facido" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fadok (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fadok
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FADOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fadok (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fadok"
        date = "2026-10-16"
    strings:
        $fam_name = "fadok" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FADOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fadok tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fadok"
        date = "2026-10-16"
    strings:
        $attrib_str = "fadok" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fakeal (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakeal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakeal (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeal"
        date = "2026-10-16"
    strings:
        $fam_name = "fakeal" ascii wide nocase
        $alias_1 = "rogue.fakealert" ascii wide nocase
        $alias_2 = "pup.fakeav" ascii wide nocase
        $alias_3 = "scareware.fakeal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakeal tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeal"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakeal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fakecoder (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakecoder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKECODER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakecoder (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakecoder"
        date = "2026-10-16"
    strings:
        $fam_name = "fakecoder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKECODER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakecoder tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakecoder"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakecoder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fakedos (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakedos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEDOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakedos (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakedos"
        date = "2026-10-16"
    strings:
        $fam_name = "fakedos" ascii wide nocase
        $alias_1 = "trojan.fakedos" ascii wide nocase
        $alias_2 = "hacktool.fakedos" ascii wide nocase
        $alias_3 = "win32/fakedos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEDOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakedos tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakedos"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakedos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fakeff (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakeff
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEFF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakeff (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeff"
        date = "2026-10-16"
    strings:
        $fam_name = "fakeff" ascii wide nocase
        $alias_1 = "adware.fakeff" ascii wide nocase
        $alias_2 = "pup.fakefirefox" ascii wide nocase
        $alias_3 = "trojan.fakebrowser" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEFF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakeff tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeff"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakeff" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fakefolder (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakefolder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEFOLDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakefolder (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakefolder"
        date = "2026-10-16"
    strings:
        $fam_name = "fakefolder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEFOLDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakefolder tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakefolder"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakefolder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fakehack (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakehack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEHACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakehack (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakehack"
        date = "2026-10-16"
    strings:
        $fam_name = "fakehack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEHACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakehack tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakehack"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakehack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fakeie (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakeie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakeie (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeie"
        date = "2026-10-16"
    strings:
        $fam_name = "fakeie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakeie tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeie"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakeie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fakeime (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakeime
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEIME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakeime (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeime"
        date = "2026-10-16"
    strings:
        $fam_name = "fakeime" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEIME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakeime tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeime"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakeime" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fakeinstaller (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakeinstaller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEINSTALLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakeinstaller (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeinstaller"
        date = "2026-10-16"
    strings:
        $fam_name = "fakeinstaller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEINSTALLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakeinstaller tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeinstaller"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakeinstaller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fakeoff (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakeoff
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEOFF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakeoff (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeoff"
        date = "2026-10-16"
    strings:
        $fam_name = "fakeoff" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEOFF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakeoff tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeoff"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakeoff" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fakeplayer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakeplayer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEPLAYER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakeplayer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeplayer"
        date = "2026-10-16"
    strings:
        $fam_name = "fakeplayer" ascii wide nocase
        $alias_1 = "trojan.fakeplayer" ascii wide nocase
        $alias_2 = "downloader.fakeplayer" ascii wide nocase
        $alias_3 = "win32/fakeplayer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEPLAYER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakeplayer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeplayer"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakeplayer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fakeransom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakeransom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKERANSOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakeransom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeransom"
        date = "2026-10-16"
    strings:
        $fam_name = "fakeransom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKERANSOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakeransom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakeransom"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakeransom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fakerean (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakerean
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKEREAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakerean (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakerean"
        date = "2026-10-16"
    strings:
        $fam_name = "fakerean" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKEREAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakerean tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakerean"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakerean" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fakesmoke (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakesmoke
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKESMOKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakesmoke (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakesmoke"
        date = "2026-10-16"
    strings:
        $fam_name = "fakesmoke" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKESMOKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakesmoke tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakesmoke"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakesmoke" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fakesupport (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakesupport
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKESUPPORT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakesupport (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakesupport"
        date = "2026-10-16"
    strings:
        $fam_name = "fakesupport" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKESUPPORT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakesupport tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakesupport"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakesupport" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fakesysdef (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fakesysdef
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKESYSDEF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakesysdef (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakesysdef"
        date = "2026-10-16"
    strings:
        $fam_name = "fakesysdef" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKESYSDEF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakesysdef tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fakesysdef"
        date = "2026-10-16"
    strings:
        $attrib_str = "fakesysdef" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Faketool (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/faketool
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAKETOOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Faketool (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/faketool"
        date = "2026-10-16"
    strings:
        $fam_name = "faketool" ascii wide nocase
        $alias_1 = "trojan:win32/faketool" ascii wide nocase
        $alias_2 = "rogue:win32/faketool" ascii wide nocase
        $alias_3 = "pua:win32/faketool" ascii wide nocase
        $alias_4 = "win32/faketool" ascii wide nocase
        $alias_5 = "program:win32/faketool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAKETOOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Faketool tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/faketool"
        date = "2026-10-16"
    strings:
        $attrib_str = "faketool" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Familykeylogger (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/familykeylogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAMILYKEYLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Familykeylogger (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/familykeylogger"
        date = "2026-10-16"
    strings:
        $fam_name = "familykeylogger" ascii wide nocase
        $alias_1 = "spyware.familykeylogger" ascii wide nocase
        $alias_2 = "pup.keylogger" ascii wide nocase
        $alias_3 = "monitor.familykeylogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAMILYKEYLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Familykeylogger tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/familykeylogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "familykeylogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Famvt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/famvt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAMVT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Famvt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/famvt"
        date = "2026-10-16"
    strings:
        $fam_name = "famvt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAMVT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Famvt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/famvt"
        date = "2026-10-16"
    strings:
        $attrib_str = "famvt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fantom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fantom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FANTOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fantom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fantom"
        date = "2026-10-16"
    strings:
        $fam_name = "fantom" ascii wide nocase
        $alias_1 = "ransom.fantom" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.fantom" ascii wide nocase
        $alias_3 = "win32/filecoder.fantom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FANTOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fantom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fantom"
        date = "2026-10-16"
    strings:
        $attrib_str = "fantom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fareit (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fareit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAREIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fareit (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fareit"
        date = "2026-10-16"
    strings:
        $fam_name = "fareit" ascii wide nocase
        $alias_1 = "fareit" ascii wide nocase
        $alias_2 = "pony" ascii wide nocase
        $alias_3 = "pony stealer" ascii wide nocase
        $alias_4 = "pony loader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAREIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fareit tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fareit"
        date = "2026-10-16"
    strings:
        $attrib_str = "fareit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fareitvb (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fareitvb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAREITVB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fareitvb (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fareitvb"
        date = "2026-10-16"
    strings:
        $fam_name = "fareitvb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAREITVB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fareitvb tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fareitvb"
        date = "2026-10-16"
    strings:
        $attrib_str = "fareitvb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Farfli (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/farfli
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FARFLI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Farfli (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/farfli"
        date = "2026-10-16"
    strings:
        $fam_name = "farfli" ascii wide nocase
        $alias_1 = "farfli" ascii wide nocase
        $alias_2 = "trojan:win32/farfli" ascii wide nocase
        $alias_3 = "backdoor.farfli" ascii wide nocase
        $alias_4 = "farfli rat" ascii wide nocase
        $alias_5 = "backdoor.win32.farfli" ascii wide nocase
        $alias_6 = "win32/farfli" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FARFLI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Farfli tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/farfli"
        date = "2026-10-16"
    strings:
        $attrib_str = "farfli" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Farsistall (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/farsistall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FARSISTALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Farsistall (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/farsistall"
        date = "2026-10-16"
    strings:
        $fam_name = "farsistall" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FARSISTALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Farsistall tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/farsistall"
        date = "2026-10-16"
    strings:
        $attrib_str = "farsistall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fasem (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fasem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FASEM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fasem (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fasem"
        date = "2026-10-16"
    strings:
        $fam_name = "fasem" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FASEM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fasem tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fasem"
        date = "2026-10-16"
    strings:
        $attrib_str = "fasem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fasong (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fasong
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FASONG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fasong (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fasong"
        date = "2026-10-16"
    strings:
        $fam_name = "fasong" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FASONG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fasong tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fasong"
        date = "2026-10-16"
    strings:
        $attrib_str = "fasong" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fastpc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fastpc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FASTPC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fastpc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fastpc"
        date = "2026-10-16"
    strings:
        $fam_name = "fastpc" ascii wide nocase
        $alias_1 = "rogue.fastpc" ascii wide nocase
        $alias_2 = "pup.fastpc" ascii wide nocase
        $alias_3 = "scareware.fastpc" ascii wide nocase
        $alias_4 = "fakeoptimizer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FASTPC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fastpc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fastpc"
        date = "2026-10-16"
    strings:
        $attrib_str = "fastpc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Favadd (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/favadd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAVADD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Favadd (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/favadd"
        date = "2026-10-16"
    strings:
        $fam_name = "favadd" ascii wide nocase
        $alias_1 = "adware.favadd" ascii wide nocase
        $alias_2 = "trojan.favadd" ascii wide nocase
        $alias_3 = "pup.favadd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAVADD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Favadd tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/favadd"
        date = "2026-10-16"
    strings:
        $attrib_str = "favadd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fayu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fayu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FAYU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fayu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fayu"
        date = "2026-10-16"
    strings:
        $fam_name = "fayu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FAYU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fayu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fayu"
        date = "2026-10-16"
    strings:
        $attrib_str = "fayu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fbng (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fbng
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FBNG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fbng (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fbng"
        date = "2026-10-16"
    strings:
        $fam_name = "fbng" ascii wide nocase
        $alias_1 = "trojan.fbng" ascii wide nocase
        $alias_2 = "downloader.fbng" ascii wide nocase
        $alias_3 = "win32/fbng" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FBNG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fbng tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fbng"
        date = "2026-10-16"
    strings:
        $attrib_str = "fbng" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fbsi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fbsi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FBSI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fbsi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fbsi"
        date = "2026-10-16"
    strings:
        $fam_name = "fbsi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FBSI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fbsi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fbsi"
        date = "2026-10-16"
    strings:
        $attrib_str = "fbsi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fbtaken (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fbtaken
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FBTAKEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fbtaken (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fbtaken"
        date = "2026-10-16"
    strings:
        $fam_name = "fbtaken" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FBTAKEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fbtaken tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fbtaken"
        date = "2026-10-16"
    strings:
        $attrib_str = "fbtaken" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fcb569F (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fcb569f
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FCB569F_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fcb569F (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fcb569f"
        date = "2026-10-16"
    strings:
        $fam_name = "fcb569f" ascii wide nocase
        $alias_1 = "generic.fcb569f" ascii wide nocase
        $alias_2 = "suspicious.fcb569f" ascii wide nocase
        $alias_3 = "heur.fcb569f" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FCB569F_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fcb569F tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fcb569f"
        date = "2026-10-16"
    strings:
        $attrib_str = "fcb569f" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fdoh (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fdoh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FDOH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fdoh (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fdoh"
        date = "2026-10-16"
    strings:
        $fam_name = "fdoh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FDOH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fdoh tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fdoh"
        date = "2026-10-16"
    strings:
        $attrib_str = "fdoh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fearless_Key_Spy (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fearless_key_spy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FEARLESS_KEY_SPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fearless_Key_Spy (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fearless_key_spy"
        date = "2026-10-16"
    strings:
        $fam_name = "fearless_key_spy" ascii wide nocase
        $alias_1 = "trojan-spy.win32.fearlesskeyspy" ascii wide nocase
        $alias_2 = "spyware.win32.fearless" ascii wide nocase
        $alias_3 = "trojan.spy.fearlesskeyspy" ascii wide nocase
        $alias_4 = "win32/fearless.spyware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FEARLESS_KEY_SPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fearless_Key_Spy tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fearless_key_spy"
        date = "2026-10-16"
    strings:
        $attrib_str = "fearless_key_spy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fearless_Lite (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fearless_lite
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FEARLESS_LITE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fearless_Lite (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fearless_lite"
        date = "2026-10-16"
    strings:
        $fam_name = "fearless_lite" ascii wide nocase
        $alias_1 = "trojan-spy.win32.fearlesslite" ascii wide nocase
        $alias_2 = "spyware.fearlesslite" ascii wide nocase
        $alias_3 = "win32/fearlesslite.spyware" ascii wide nocase
        $alias_4 = "trojan.spy.fearlesslite" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FEARLESS_LITE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fearless_Lite tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fearless_lite"
        date = "2026-10-16"
    strings:
        $attrib_str = "fearless_lite" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fearso (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fearso
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FEARSO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fearso (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fearso"
        date = "2026-10-16"
    strings:
        $fam_name = "fearso" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FEARSO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fearso tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fearso"
        date = "2026-10-16"
    strings:
        $attrib_str = "fearso" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Feebs (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/feebs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FEEBS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Feebs (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/feebs"
        date = "2026-10-16"
    strings:
        $fam_name = "feebs" ascii wide nocase
        $alias_1 = "worm.win32.feebs" ascii wide nocase
        $alias_2 = "w32/feebs" ascii wide nocase
        $alias_3 = "trojan.feebs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FEEBS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Feebs tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/feebs"
        date = "2026-10-16"
    strings:
        $attrib_str = "feebs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Feedarch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/feedarch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FEEDARCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Feedarch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/feedarch"
        date = "2026-10-16"
    strings:
        $fam_name = "feedarch" ascii wide nocase
        $alias_1 = "adware.feedarch" ascii wide nocase
        $alias_2 = "pup.feedarch" ascii wide nocase
        $alias_3 = "browsermodifier:win32/feedarch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FEEDARCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Feedarch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/feedarch"
        date = "2026-10-16"
    strings:
        $attrib_str = "feedarch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fenomengame (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fenomengame
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FENOMENGAME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fenomengame (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fenomengame"
        date = "2026-10-16"
    strings:
        $fam_name = "fenomengame" ascii wide nocase
        $alias_1 = "adware.fenomengame" ascii wide nocase
        $alias_2 = "pup.fenomengame" ascii wide nocase
        $alias_3 = "browsermodifier:win32/fenomengame" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FENOMENGAME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fenomengame tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fenomengame"
        date = "2026-10-16"
    strings:
        $attrib_str = "fenomengame" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fesber (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fesber
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FESBER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fesber (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fesber"
        date = "2026-10-16"
    strings:
        $fam_name = "fesber" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FESBER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fesber tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fesber"
        date = "2026-10-16"
    strings:
        $attrib_str = "fesber" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fgarb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fgarb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FGARB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fgarb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fgarb"
        date = "2026-10-16"
    strings:
        $fam_name = "fgarb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FGARB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fgarb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fgarb"
        date = "2026-10-16"
    strings:
        $attrib_str = "fgarb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Figyek (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/figyek
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FIGYEK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Figyek (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/figyek"
        date = "2026-10-16"
    strings:
        $fam_name = "figyek" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FIGYEK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Figyek tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/figyek"
        date = "2026-10-16"
    strings:
        $attrib_str = "figyek" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Filefinder (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/filefinder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FILEFINDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Filefinder (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filefinder"
        date = "2026-10-16"
    strings:
        $fam_name = "filefinder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FILEFINDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Filefinder tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filefinder"
        date = "2026-10-16"
    strings:
        $attrib_str = "filefinder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Filepatch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/filepatch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FILEPATCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Filepatch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filepatch"
        date = "2026-10-16"
    strings:
        $fam_name = "filepatch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FILEPATCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Filepatch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filepatch"
        date = "2026-10-16"
    strings:
        $attrib_str = "filepatch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Filerepmalware (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/filerepmalware
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FILEREPMALWARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Filerepmalware (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filerepmalware"
        date = "2026-10-16"
    strings:
        $fam_name = "filerepmalware" ascii wide nocase
        $alias_1 = "win32:filerepmalware [trj]" ascii wide nocase
        $alias_2 = "filerepmalware [pup]" ascii wide nocase
        $alias_3 = "win64:filerepmalware" ascii wide nocase
        $alias_4 = "filerepmalware" ascii wide nocase
        $alias_5 = "win32:filerepmalware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FILEREPMALWARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Filerepmalware tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filerepmalware"
        date = "2026-10-16"
    strings:
        $attrib_str = "filerepmalware" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Filerepmetagen (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/filerepmetagen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FILEREPMETAGEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Filerepmetagen (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filerepmetagen"
        date = "2026-10-16"
    strings:
        $fam_name = "filerepmetagen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FILEREPMETAGEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Filerepmetagen tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filerepmetagen"
        date = "2026-10-16"
    strings:
        $attrib_str = "filerepmetagen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Filetour (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/filetour
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FILETOUR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Filetour (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filetour"
        date = "2026-10-16"
    strings:
        $fam_name = "filetour" ascii wide nocase
        $alias_1 = "trojan:win32/filetour" ascii wide nocase
        $alias_2 = "adware.filetour" ascii wide nocase
        $alias_3 = "pua:win32/filetour" ascii wide nocase
        $alias_4 = "pup.optional.filetour" ascii wide nocase
        $alias_5 = "trojan.filetour" ascii wide nocase
        $alias_6 = "win32/filetour.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FILETOUR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Filetour tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filetour"
        date = "2026-10-16"
    strings:
        $attrib_str = "filetour" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Filoskeed (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/filoskeed
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FILOSKEED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Filoskeed (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filoskeed"
        date = "2026-10-16"
    strings:
        $fam_name = "filoskeed" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FILOSKEED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Filoskeed tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/filoskeed"
        date = "2026-10-16"
    strings:
        $attrib_str = "filoskeed" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Findkeyxp (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/findkeyxp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FINDKEYXP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Findkeyxp (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/findkeyxp"
        date = "2026-10-16"
    strings:
        $fam_name = "findkeyxp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FINDKEYXP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Findkeyxp tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/findkeyxp"
        date = "2026-10-16"
    strings:
        $attrib_str = "findkeyxp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Finfish (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/finfish
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FINFISH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Finfish (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/finfish"
        date = "2026-10-16"
    strings:
        $fam_name = "finfish" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FINFISH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Finfish tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/finfish"
        date = "2026-10-16"
    strings:
        $attrib_str = "finfish" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fire (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fire
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FIRE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fire (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fire"
        date = "2026-10-16"
    strings:
        $fam_name = "fire" ascii wide nocase
        $alias_1 = "virus.win32.fire" ascii wide nocase
        $alias_2 = "worm.fire" ascii wide nocase
        $alias_3 = "trojan.fire" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FIRE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fire tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fire"
        date = "2026-10-16"
    strings:
        $attrib_str = "fire" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Firehooker (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/firehooker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FIREHOOKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Firehooker (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/firehooker"
        date = "2026-10-16"
    strings:
        $fam_name = "firehooker" ascii wide nocase
        $alias_1 = "trojan.firehooker" ascii wide nocase
        $alias_2 = "pws.firehooker" ascii wide nocase
        $alias_3 = "banker.hooker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FIREHOOKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Firehooker tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/firehooker"
        date = "2026-10-16"
    strings:
        $attrib_str = "firehooker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Firseria (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/firseria
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FIRSERIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Firseria (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/firseria"
        date = "2026-10-16"
    strings:
        $fam_name = "firseria" ascii wide nocase
        $alias_1 = "adware:win32/firseria" ascii wide nocase
        $alias_2 = "program:win32/firseria" ascii wide nocase
        $alias_3 = "pua:win32/firseria" ascii wide nocase
        $alias_4 = "pua.win32.firseria.ac" ascii wide nocase
        $alias_5 = "win32/firseria" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FIRSERIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Firseria tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/firseria"
        date = "2026-10-16"
    strings:
        $attrib_str = "firseria" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Firstinj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/firstinj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FIRSTINJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Firstinj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/firstinj"
        date = "2026-10-16"
    strings:
        $fam_name = "firstinj" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FIRSTINJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Firstinj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/firstinj"
        date = "2026-10-16"
    strings:
        $attrib_str = "firstinj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Flawedammyy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flawedammyy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLAWEDAMMYY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flawedammyy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flawedammyy"
        date = "2026-10-16"
    strings:
        $fam_name = "flawedammyy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLAWEDAMMYY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flawedammyy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flawedammyy"
        date = "2026-10-16"
    strings:
        $attrib_str = "flawedammyy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fleercivet (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fleercivet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLEERCIVET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fleercivet (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fleercivet"
        date = "2026-10-16"
    strings:
        $fam_name = "fleercivet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLEERCIVET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fleercivet tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fleercivet"
        date = "2026-10-16"
    strings:
        $attrib_str = "fleercivet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Flinject (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flinject
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLINJECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flinject (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flinject"
        date = "2026-10-16"
    strings:
        $fam_name = "flinject" ascii wide nocase
        $alias_1 = "trojan.inject" ascii wide nocase
        $alias_2 = "injector.flinject" ascii wide nocase
        $alias_3 = "win32/injector" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLINJECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flinject tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flinject"
        date = "2026-10-16"
    strings:
        $attrib_str = "flinject" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Floder (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/floder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLODER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Floder (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/floder"
        date = "2026-10-16"
    strings:
        $fam_name = "floder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLODER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Floder tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/floder"
        date = "2026-10-16"
    strings:
        $attrib_str = "floder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Flowershop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flowershop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLOWERSHOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flowershop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flowershop"
        date = "2026-10-16"
    strings:
        $fam_name = "flowershop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLOWERSHOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flowershop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flowershop"
        date = "2026-10-16"
    strings:
        $attrib_str = "flowershop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Flowspirit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flowspirit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLOWSPIRIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flowspirit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flowspirit"
        date = "2026-10-16"
    strings:
        $fam_name = "flowspirit" ascii wide nocase
        $alias_1 = "adware.flowspirit" ascii wide nocase
        $alias_2 = "pup.flowspirit" ascii wide nocase
        $alias_3 = "browserhijacker.flowspirit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLOWSPIRIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flowspirit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flowspirit"
        date = "2026-10-16"
    strings:
        $attrib_str = "flowspirit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Flusihoc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flusihoc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLUSIHOC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flusihoc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flusihoc"
        date = "2026-10-16"
    strings:
        $fam_name = "flusihoc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLUSIHOC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flusihoc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flusihoc"
        date = "2026-10-16"
    strings:
        $attrib_str = "flusihoc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Flux (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flux
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLUX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flux (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flux"
        date = "2026-10-16"
    strings:
        $fam_name = "flux" ascii wide nocase
        $alias_1 = "backdoor:win32/flux" ascii wide nocase
        $alias_2 = "trojan.win32.flux" ascii wide nocase
        $alias_3 = "win32/flux.backdoor" ascii wide nocase
        $alias_4 = "backdoor.flux.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLUX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flux tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flux"
        date = "2026-10-16"
    strings:
        $attrib_str = "flux" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Flvdirect (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flvdirect
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLVDIRECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flvdirect (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flvdirect"
        date = "2026-10-16"
    strings:
        $fam_name = "flvdirect" ascii wide nocase
        $alias_1 = "adware.flvdirect" ascii wide nocase
        $alias_2 = "pup.flvdirect" ascii wide nocase
        $alias_3 = "win32/adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLVDIRECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flvdirect tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flvdirect"
        date = "2026-10-16"
    strings:
        $attrib_str = "flvdirect" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Flvdownloader (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flvdownloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLVDOWNLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flvdownloader (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flvdownloader"
        date = "2026-10-16"
    strings:
        $fam_name = "flvdownloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLVDOWNLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flvdownloader tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flvdownloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "flvdownloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Flymux (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flymux
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLYMUX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flymux (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flymux"
        date = "2026-10-16"
    strings:
        $fam_name = "flymux" ascii wide nocase
        $alias_1 = "trojan.flymux" ascii wide nocase
        $alias_2 = "pws.flymux" ascii wide nocase
        $alias_3 = "trojanspy.flymux" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLYMUX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flymux tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flymux"
        date = "2026-10-16"
    strings:
        $attrib_str = "flymux" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Flystudi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flystudi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLYSTUDI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flystudi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flystudi"
        date = "2026-10-16"
    strings:
        $fam_name = "flystudi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLYSTUDI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flystudi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flystudi"
        date = "2026-10-16"
    strings:
        $attrib_str = "flystudi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Flystudio (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/flystudio
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FLYSTUDIO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Flystudio (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flystudio"
        date = "2026-10-16"
    strings:
        $fam_name = "flystudio" ascii wide nocase
        $alias_1 = "packer:win32/flystudio" ascii wide nocase
        $alias_2 = "trojan:win32/flystudio" ascii wide nocase
        $alias_3 = "trojan.malpack.flystudio" ascii wide nocase
        $alias_4 = "win32/flystudio.packer" ascii wide nocase
        $alias_5 = "flystudio.runtime" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FLYSTUDIO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Flystudio tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/flystudio"
        date = "2026-10-16"
    strings:
        $attrib_str = "flystudio" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fmgfagns0Sge (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fmgfagns0sge
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FMGFAGNS0SGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fmgfagns0Sge (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fmgfagns0sge"
        date = "2026-10-16"
    strings:
        $fam_name = "fmgfagns0sge" ascii wide nocase
        $alias_1 = "trojan.generic.fmgfagns0sge" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FMGFAGNS0SGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fmgfagns0Sge tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fmgfagns0sge"
        date = "2026-10-16"
    strings:
        $attrib_str = "fmgfagns0sge" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fnwabyxmbkm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fnwabyxmbkm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FNWABYXMBKM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fnwabyxmbkm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fnwabyxmbkm"
        date = "2026-10-16"
    strings:
        $fam_name = "fnwabyxmbkm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FNWABYXMBKM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fnwabyxmbkm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fnwabyxmbkm"
        date = "2026-10-16"
    strings:
        $attrib_str = "fnwabyxmbkm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Foler (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/foler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FOLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Foler (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/foler"
        date = "2026-10-16"
    strings:
        $fam_name = "foler" ascii wide nocase
        $alias_1 = "trojan.foler" ascii wide nocase
        $alias_2 = "downloader.foler" ascii wide nocase
        $alias_3 = "win32/foler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FOLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Foler tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/foler"
        date = "2026-10-16"
    strings:
        $attrib_str = "foler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Folstart (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/folstart
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FOLSTART_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Folstart (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/folstart"
        date = "2026-10-16"
    strings:
        $fam_name = "folstart" ascii wide nocase
        $alias_1 = "trojan.folstart" ascii wide nocase
        $alias_2 = "downloader.folstart" ascii wide nocase
        $alias_3 = "win32/folstart" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FOLSTART_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Folstart tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/folstart"
        date = "2026-10-16"
    strings:
        $attrib_str = "folstart" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fontra (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fontra
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FONTRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fontra (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fontra"
        date = "2026-10-16"
    strings:
        $fam_name = "fontra" ascii wide nocase
        $alias_1 = "browsermodifier:win32/fontra" ascii wide nocase
        $alias_2 = "adware:win32/fontra" ascii wide nocase
        $alias_3 = "pua:win32/fontra" ascii wide nocase
        $alias_4 = "win32/fontra" ascii wide nocase
        $alias_5 = "fontra adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FONTRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fontra tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fontra"
        date = "2026-10-16"
    strings:
        $attrib_str = "fontra" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Food (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/food
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FOOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Food (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/food"
        date = "2026-10-16"
    strings:
        $fam_name = "food" ascii wide nocase
        $alias_1 = "trojan.food" ascii wide nocase
        $alias_2 = "downloader.food" ascii wide nocase
        $alias_3 = "win32/food" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FOOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Food tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/food"
        date = "2026-10-16"
    strings:
        $attrib_str = "food" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Forbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/forbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FORBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Forbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/forbot"
        date = "2026-10-16"
    strings:
        $fam_name = "forbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FORBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Forbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/forbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "forbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Forcestartpage (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/forcestartpage
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FORCESTARTPAGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Forcestartpage (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/forcestartpage"
        date = "2026-10-16"
    strings:
        $fam_name = "forcestartpage" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FORCESTARTPAGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Forcestartpage tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/forcestartpage"
        date = "2026-10-16"
    strings:
        $attrib_str = "forcestartpage" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Formbook (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/formbook
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FORMBOOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Formbook (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/formbook"
        date = "2026-10-16"
    strings:
        $fam_name = "formbook" ascii wide nocase
        $alias_1 = "formbook" ascii wide nocase
        $alias_2 = "xloader" ascii wide nocase
        $alias_3 = "infostealer.formbook" ascii wide nocase
        $alias_4 = "trojan.formgrabber" ascii wide nocase
        $alias_5 = "win32/formbook" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FORMBOOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Formbook tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/formbook"
        date = "2026-10-16"
    strings:
        $attrib_str = "formbook" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fosniw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fosniw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FOSNIW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fosniw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fosniw"
        date = "2026-10-16"
    strings:
        $fam_name = "fosniw" ascii wide nocase
        $alias_1 = "worm.fosniw" ascii wide nocase
        $alias_2 = "trojan.fosniw" ascii wide nocase
        $alias_3 = "w32/fosniw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FOSNIW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fosniw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fosniw"
        date = "2026-10-16"
    strings:
        $attrib_str = "fosniw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fotopapps (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fotopapps
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FOTOPAPPS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fotopapps (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fotopapps"
        date = "2026-10-16"
    strings:
        $fam_name = "fotopapps" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FOTOPAPPS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fotopapps tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fotopapps"
        date = "2026-10-16"
    strings:
        $attrib_str = "fotopapps" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fourthrem (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fourthrem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FOURTHREM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fourthrem (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fourthrem"
        date = "2026-10-16"
    strings:
        $fam_name = "fourthrem" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FOURTHREM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fourthrem tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fourthrem"
        date = "2026-10-16"
    strings:
        $attrib_str = "fourthrem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Foxhiex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/foxhiex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FOXHIEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Foxhiex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/foxhiex"
        date = "2026-10-16"
    strings:
        $fam_name = "foxhiex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FOXHIEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Foxhiex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/foxhiex"
        date = "2026-10-16"
    strings:
        $attrib_str = "foxhiex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fraud (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fraud
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FRAUD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fraud (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraud"
        date = "2026-10-16"
    strings:
        $fam_name = "fraud" ascii wide nocase
        $alias_1 = "rogue.fraud" ascii wide nocase
        $alias_2 = "scareware.fraud" ascii wide nocase
        $alias_3 = "fakeav" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FRAUD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fraud tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraud"
        date = "2026-10-16"
    strings:
        $attrib_str = "fraud" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fraudkrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fraudkrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FRAUDKRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fraudkrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraudkrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "fraudkrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FRAUDKRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fraudkrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraudkrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "fraudkrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fraudload (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fraudload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FRAUDLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fraudload (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraudload"
        date = "2026-10-16"
    strings:
        $fam_name = "fraudload" ascii wide nocase
        $alias_1 = "trojandownloader:win32/fraudload" ascii wide nocase
        $alias_2 = "trojan.fraudload" ascii wide nocase
        $alias_3 = "trojan-downloader.win32.fraudload" ascii wide nocase
        $alias_4 = "win32/fraudload" ascii wide nocase
        $alias_5 = "fakeav loader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FRAUDLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fraudload tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraudload"
        date = "2026-10-16"
    strings:
        $attrib_str = "fraudload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fraudpack (Exploit_Kit)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fraudpack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FRAUDPACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fraudpack (Exploit_Kit)"
        category = "Exploit_Kit"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraudpack"
        date = "2026-10-16"
    strings:
        $fam_name = "fraudpack" ascii wide nocase
        $alias_1 = "exploit:win32/fraudpack" ascii wide nocase
        $alias_2 = "trojandownloader:win32/fraudpack" ascii wide nocase
        $alias_3 = "win32/fraudpack" ascii wide nocase
        $alias_4 = "fraudpack exploit kit" ascii wide nocase
        $alias_5 = "fraudpack crimeware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FRAUDPACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fraudpack tradecraft"
        category = "Exploit_Kit"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraudpack"
        date = "2026-10-16"
    strings:
        $attrib_str = "fraudpack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fraudrop (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fraudrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FRAUDROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fraudrop (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraudrop"
        date = "2026-10-16"
    strings:
        $fam_name = "fraudrop" ascii wide nocase
        $alias_1 = "trojandropper:win32/fraudrop" ascii wide nocase
        $alias_2 = "trojan:win32/fraudrop" ascii wide nocase
        $alias_3 = "win32/fraudrop" ascii wide nocase
        $alias_4 = "trojandropper.fraudrop" ascii wide nocase
        $alias_5 = "fraudrop stager" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FRAUDROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fraudrop tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraudrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "fraudrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fraudster (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fraudster
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FRAUDSTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fraudster (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraudster"
        date = "2026-10-16"
    strings:
        $fam_name = "fraudster" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FRAUDSTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fraudster tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fraudster"
        date = "2026-10-16"
    strings:
        $attrib_str = "fraudster" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Freekeylogger (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/freekeylogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FREEKEYLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Freekeylogger (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/freekeylogger"
        date = "2026-10-16"
    strings:
        $fam_name = "freekeylogger" ascii wide nocase
        $alias_1 = "spyware:win32/freekeylogger" ascii wide nocase
        $alias_2 = "monitoringtool:win32/freekeylogger" ascii wide nocase
        $alias_3 = "pua:win32/freekeylogger" ascii wide nocase
        $alias_4 = "free keylogger spyware" ascii wide nocase
        $alias_5 = "spyware.freekeylogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FREEKEYLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Freekeylogger tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/freekeylogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "freekeylogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Freenew (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/freenew
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FREENEW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Freenew (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/freenew"
        date = "2026-10-16"
    strings:
        $fam_name = "freenew" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FREENEW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Freenew tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/freenew"
        date = "2026-10-16"
    strings:
        $attrib_str = "freenew" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Frethog (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/frethog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FRETHOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Frethog (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/frethog"
        date = "2026-10-16"
    strings:
        $fam_name = "frethog" ascii wide nocase
        $alias_1 = "pws:win32/frethog" ascii wide nocase
        $alias_2 = "trojan.pws.frethog" ascii wide nocase
        $alias_3 = "infostealer.frethog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FRETHOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Frethog tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/frethog"
        date = "2026-10-16"
    strings:
        $attrib_str = "frethog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Frethoq (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/frethoq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FRETHOQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Frethoq (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/frethoq"
        date = "2026-10-16"
    strings:
        $fam_name = "frethoq" ascii wide nocase
        $alias_1 = "trojan.frethoq" ascii wide nocase
        $alias_2 = "downloader.frethoq" ascii wide nocase
        $alias_3 = "win32/frethoq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FRETHOQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Frethoq tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/frethoq"
        date = "2026-10-16"
    strings:
        $attrib_str = "frethoq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Freyja (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/freyja
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FREYJA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Freyja (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/freyja"
        date = "2026-10-16"
    strings:
        $fam_name = "freyja" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FREYJA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Freyja tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/freyja"
        date = "2026-10-16"
    strings:
        $attrib_str = "freyja" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Frosparf (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/frosparf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FROSPARF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Frosparf (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/frosparf"
        date = "2026-10-16"
    strings:
        $fam_name = "frosparf" ascii wide nocase
        $alias_1 = "trojan.frosparf" ascii wide nocase
        $alias_2 = "downloader.frosparf" ascii wide nocase
        $alias_3 = "win32/frosparf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FROSPARF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Frosparf tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/frosparf"
        date = "2026-10-16"
    strings:
        $attrib_str = "frosparf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fspm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fspm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FSPM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fspm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fspm"
        date = "2026-10-16"
    strings:
        $fam_name = "fspm" ascii wide nocase
        $alias_1 = "hacktool.fspm" ascii wide nocase
        $alias_2 = "exploit.win32.fspm" ascii wide nocase
        $alias_3 = "tool.networkscanner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FSPM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fspm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fspm"
        date = "2026-10-16"
    strings:
        $attrib_str = "fspm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fsysna (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fsysna
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FSYSNA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fsysna (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fsysna"
        date = "2026-10-16"
    strings:
        $fam_name = "fsysna" ascii wide nocase
        $alias_1 = "fsysna" ascii wide nocase
        $alias_2 = "trojan:win32/fsysna" ascii wide nocase
        $alias_3 = "trojan.win32.fsysna" ascii wide nocase
        $alias_4 = "win32/fsysna" ascii wide nocase
        $alias_5 = "trojan.win32.fsysna" ascii wide nocase
        $alias_6 = "fsysna loader" ascii wide nocase
        $alias_7 = "trojan:win32/fsysna.gen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FSYSNA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fsysna tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fsysna"
        date = "2026-10-16"
    strings:
        $attrib_str = "fsysna" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fuerboos (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fuerboos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FUERBOOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fuerboos (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fuerboos"
        date = "2026-10-16"
    strings:
        $fam_name = "fuerboos" ascii wide nocase
        $alias_1 = "trojan:win32/fuerboos" ascii wide nocase
        $alias_2 = "trojan:win32/fuerboos!cl" ascii wide nocase
        $alias_3 = "trojan:win32/fuerboos!mtb" ascii wide nocase
        $alias_4 = "trojandownloader:win32/fuerboos" ascii wide nocase
        $alias_5 = "win32/bearfoos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FUERBOOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fuerboos tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fuerboos"
        date = "2026-10-16"
    strings:
        $attrib_str = "fuerboos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fuery (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fuery
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FUERY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fuery (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fuery"
        date = "2026-10-16"
    strings:
        $fam_name = "fuery" ascii wide nocase
        $alias_1 = "trojan:win32/fuery" ascii wide nocase
        $alias_2 = "trojan:win32/fuery.a!cl" ascii wide nocase
        $alias_3 = "trojan:win32/fuery.b!cl" ascii wide nocase
        $alias_4 = "win32/fuery" ascii wide nocase
        $alias_5 = "trojan.fuery" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FUERY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fuery tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fuery"
        date = "2026-10-16"
    strings:
        $attrib_str = "fuery" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Fugrafa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fugrafa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FUGRAFA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fugrafa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fugrafa"
        date = "2026-10-16"
    strings:
        $fam_name = "fugrafa" ascii wide nocase
        $alias_1 = "ransom:win32/fugrafa" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.fugrafa" ascii wide nocase
        $alias_3 = "win32/fugrafa" ascii wide nocase
        $alias_4 = "ransom.fugrafa" ascii wide nocase
        $alias_5 = "fugrafa ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FUGRAFA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fugrafa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fugrafa"
        date = "2026-10-16"
    strings:
        $attrib_str = "fugrafa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fujacks (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fujacks
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FUJACKS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fujacks (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fujacks"
        date = "2026-10-16"
    strings:
        $fam_name = "fujacks" ascii wide nocase
        $alias_1 = "virus:win32/fujacks" ascii wide nocase
        $alias_2 = "worm.whboy" ascii wide nocase
        $alias_3 = "panda burning joss sticks" ascii wide nocase
        $alias_4 = "w32/fujacks" ascii wide nocase
        $alias_5 = "virus.win32.fujacks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FUJACKS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fujacks tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fujacks"
        date = "2026-10-16"
    strings:
        $attrib_str = "fujacks" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fullscreen (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fullscreen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FULLSCREEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fullscreen (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fullscreen"
        date = "2026-10-16"
    strings:
        $fam_name = "fullscreen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FULLSCREEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fullscreen tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fullscreen"
        date = "2026-10-16"
    strings:
        $attrib_str = "fullscreen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Funmood (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/funmood
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FUNMOOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Funmood (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/funmood"
        date = "2026-10-16"
    strings:
        $fam_name = "funmood" ascii wide nocase
        $alias_1 = "adware.funmoods" ascii wide nocase
        $alias_2 = "pup.funmood" ascii wide nocase
        $alias_3 = "browsermodifier:win32/funmoods" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FUNMOOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Funmood tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/funmood"
        date = "2026-10-16"
    strings:
        $attrib_str = "funmood" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Funshion (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/funshion
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FUNSHION_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Funshion (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/funshion"
        date = "2026-10-16"
    strings:
        $fam_name = "funshion" ascii wide nocase
        $alias_1 = "adware:win32/funshion" ascii wide nocase
        $alias_2 = "pua:win32/funshion" ascii wide nocase
        $alias_3 = "pup.optional.funshion" ascii wide nocase
        $alias_4 = "win32/funshion" ascii wide nocase
        $alias_5 = "funshion media player" ascii wide nocase
        $alias_6 = "adware:win32/funshion.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FUNSHION_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Funshion tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/funshion"
        date = "2026-10-16"
    strings:
        $attrib_str = "funshion" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fusioncore (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fusioncore
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FUSIONCORE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fusioncore (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fusioncore"
        date = "2026-10-16"
    strings:
        $fam_name = "fusioncore" ascii wide nocase
        $alias_1 = "adware:win32/fusioncore" ascii wide nocase
        $alias_2 = "pua:win32/fusioncore" ascii wide nocase
        $alias_3 = "softwarebundler:win32/fusioncore" ascii wide nocase
        $alias_4 = "adware.fusioncore" ascii wide nocase
        $alias_5 = "win32/fusioncore" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FUSIONCORE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fusioncore tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fusioncore"
        date = "2026-10-16"
    strings:
        $attrib_str = "fusioncore" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Fwwy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fwwy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FWWY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fwwy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fwwy"
        date = "2026-10-16"
    strings:
        $fam_name = "fwwy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FWWY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fwwy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fwwy"
        date = "2026-10-16"
    strings:
        $attrib_str = "fwwy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Fz4Aaueo2Jhi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/fz4aaueo2jhi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_FZ4AAUEO2JHI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fz4Aaueo2Jhi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fz4aaueo2jhi"
        date = "2026-10-16"
    strings:
        $fam_name = "fz4aaueo2jhi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_FZ4AAUEO2JHI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fz4Aaueo2Jhi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/fz4aaueo2jhi"
        date = "2026-10-16"
    strings:
        $attrib_str = "fz4aaueo2jhi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gamania (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamania
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMANIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamania (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamania"
        date = "2026-10-16"
    strings:
        $fam_name = "gamania" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMANIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamania tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamania"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamania" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gamaredon (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamaredon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMAREDON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamaredon (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamaredon"
        date = "2026-10-16"
    strings:
        $fam_name = "gamaredon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMAREDON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamaredon tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamaredon"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamaredon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gamarue (Loader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamarue
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMARUE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamarue (Loader)"
        category = "Loader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamarue"
        date = "2026-10-16"
    strings:
        $fam_name = "gamarue" ascii wide nocase
        $alias_1 = "andromeda" ascii wide nocase
        $alias_2 = "wauchos" ascii wide nocase
        $alias_3 = "gamarue" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMARUE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamarue tradecraft"
        category = "Loader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamarue"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamarue" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Game (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/game
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Game (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/game"
        date = "2026-10-16"
    strings:
        $fam_name = "game" ascii wide nocase
        $alias_1 = "game" ascii wide nocase
        $alias_2 = "trojan:win32/gamethief" ascii wide nocase
        $alias_3 = "win32/gamethief" ascii wide nocase
        $alias_4 = "trojan-psw.win32.game" ascii wide nocase
        $alias_5 = "trojan.game" ascii wide nocase
        $alias_6 = "gamethief stealer" ascii wide nocase
        $alias_7 = "trojan-gamethief.win32.game" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Game tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/game"
        date = "2026-10-16"
    strings:
        $attrib_str = "game" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gameapp (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gameapp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMEAPP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gameapp (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gameapp"
        date = "2026-10-16"
    strings:
        $fam_name = "gameapp" ascii wide nocase
        $alias_1 = "pup.gameapp" ascii wide nocase
        $alias_2 = "adware.gameapp" ascii wide nocase
        $alias_3 = "riskware.gameapp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMEAPP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gameapp tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gameapp"
        date = "2026-10-16"
    strings:
        $attrib_str = "gameapp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gamebox (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamebox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMEBOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamebox (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamebox"
        date = "2026-10-16"
    strings:
        $fam_name = "gamebox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMEBOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamebox tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamebox"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamebox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gamehack (Pua_Tool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamehack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMEHACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamehack (Pua_Tool)"
        category = "Pua_Tool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamehack"
        date = "2026-10-16"
    strings:
        $fam_name = "gamehack" ascii wide nocase
        $alias_1 = "tool:win32/gamehack" ascii wide nocase
        $alias_2 = "riskware:win32/gamehack" ascii wide nocase
        $alias_3 = "pua.win32.gamehack" ascii wide nocase
        $alias_4 = "win32/gamehack.tool" ascii wide nocase
        $alias_5 = "hacktool.win32.gamehack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMEHACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamehack tradecraft"
        category = "Pua_Tool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamehack"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamehack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gamehuck (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamehuck
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMEHUCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamehuck (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamehuck"
        date = "2026-10-16"
    strings:
        $fam_name = "gamehuck" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMEHUCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamehuck tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamehuck"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamehuck" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gamemodding (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamemodding
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMEMODDING_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamemodding (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamemodding"
        date = "2026-10-16"
    strings:
        $fam_name = "gamemodding" ascii wide nocase
        $alias_1 = "hacktool:win32/gamemodding!pz" ascii wide nocase
        $alias_2 = "pua:win32/gamemodding" ascii wide nocase
        $alias_3 = "riskware.gamemodding" ascii wide nocase
        $alias_4 = "gamemodding.net installer" ascii wide nocase
        $alias_5 = "win32/gamemodding" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMEMODDING_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamemodding tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamemodding"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamemodding" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gameol (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gameol
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMEOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gameol (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gameol"
        date = "2026-10-16"
    strings:
        $fam_name = "gameol" ascii wide nocase
        $alias_1 = "adware.gameol" ascii wide nocase
        $alias_2 = "pup.gameol" ascii wide nocase
        $alias_3 = "browsermodifier:win32/gameol" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMEOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gameol tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gameol"
        date = "2026-10-16"
    strings:
        $attrib_str = "gameol" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gameserver (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gameserver
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMESERVER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gameserver (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gameserver"
        date = "2026-10-16"
    strings:
        $fam_name = "gameserver" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMESERVER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gameserver tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gameserver"
        date = "2026-10-16"
    strings:
        $attrib_str = "gameserver" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gamethief (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamethief
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMETHIEF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamethief (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamethief"
        date = "2026-10-16"
    strings:
        $fam_name = "gamethief" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMETHIEF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamethief tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamethief"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamethief" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gametool (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gametool
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMETOOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gametool (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gametool"
        date = "2026-10-16"
    strings:
        $fam_name = "gametool" ascii wide nocase
        $alias_1 = "trojan:win32/gametool" ascii wide nocase
        $alias_2 = "spyware:win32/gametool" ascii wide nocase
        $alias_3 = "hacktool:win32/gametool" ascii wide nocase
        $alias_4 = "win32/gametool" ascii wide nocase
        $alias_5 = "gametool cheat stealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMETOOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gametool tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gametool"
        date = "2026-10-16"
    strings:
        $attrib_str = "gametool" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gamevance (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamevance
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMEVANCE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamevance (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamevance"
        date = "2026-10-16"
    strings:
        $fam_name = "gamevance" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMEVANCE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamevance tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamevance"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamevance" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gamium (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamium
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMIUM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamium (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamium"
        date = "2026-10-16"
    strings:
        $fam_name = "gamium" ascii wide nocase
        $alias_1 = "adware.gamium" ascii wide nocase
        $alias_2 = "pup.gamium" ascii wide nocase
        $alias_3 = "win32/gamium" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMIUM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamium tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamium"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamium" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gampass (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gampass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gampass (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gampass"
        date = "2026-10-16"
    strings:
        $fam_name = "gampass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gampass tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gampass"
        date = "2026-10-16"
    strings:
        $attrib_str = "gampass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gamsoft (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamsoft
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMSOFT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamsoft (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamsoft"
        date = "2026-10-16"
    strings:
        $fam_name = "gamsoft" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMSOFT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamsoft tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamsoft"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamsoft" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gamsofts (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamsofts
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMSOFTS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamsofts (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamsofts"
        date = "2026-10-16"
    strings:
        $fam_name = "gamsofts" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMSOFTS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamsofts tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamsofts"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamsofts" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gamup (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gamup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAMUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gamup (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamup"
        date = "2026-10-16"
    strings:
        $fam_name = "gamup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAMUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gamup tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gamup"
        date = "2026-10-16"
    strings:
        $attrib_str = "gamup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gandcrab (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gandcrab
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GANDCRAB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gandcrab (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gandcrab"
        date = "2026-10-16"
    strings:
        $fam_name = "gandcrab" ascii wide nocase
        $alias_1 = "gandcrab" ascii wide nocase
        $alias_2 = "gandcrab v1-v5.2" ascii wide nocase
        $alias_3 = "gdcb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GANDCRAB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gandcrab tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gandcrab"
        date = "2026-10-16"
    strings:
        $attrib_str = "gandcrab" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gandcrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gandcrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GANDCRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gandcrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gandcrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "gandcrypt" ascii wide nocase
        $alias_1 = "gandcrypt" ascii wide nocase
        $alias_2 = "ransom:win32/gandcrypt" ascii wide nocase
        $alias_3 = "trojan-ransom.win32.gandcrypt" ascii wide nocase
        $alias_4 = "ransom.gandcrab" ascii wide nocase
        $alias_5 = "win32/gandcrypt" ascii wide nocase
        $alias_6 = "gandcrab encryptor" ascii wide nocase
        $alias_7 = "ransom:win32/gandcrypt.db!mtb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GANDCRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gandcrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gandcrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "gandcrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ganelp (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ganelp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GANELP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ganelp (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ganelp"
        date = "2026-10-16"
    strings:
        $fam_name = "ganelp" ascii wide nocase
        $alias_1 = "trojan:win32/ganelp" ascii wide nocase
        $alias_2 = "trojan-spy.win32.ganelp" ascii wide nocase
        $alias_3 = "pws:win32/ganelp" ascii wide nocase
        $alias_4 = "win32/ganelp.stealer" ascii wide nocase
        $alias_5 = "spyware.ganelp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GANELP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ganelp tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ganelp"
        date = "2026-10-16"
    strings:
        $attrib_str = "ganelp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gaofenq (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gaofenq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAOFENQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gaofenq (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gaofenq"
        date = "2026-10-16"
    strings:
        $fam_name = "gaofenq" ascii wide nocase
        $alias_1 = "trojan.gaofenq" ascii wide nocase
        $alias_2 = "downloader.gaofenq" ascii wide nocase
        $alias_3 = "win32/gaofenq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAOFENQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gaofenq tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gaofenq"
        date = "2026-10-16"
    strings:
        $attrib_str = "gaofenq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gaofenquming (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gaofenquming
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GAOFENQUMING_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gaofenquming (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gaofenquming"
        date = "2026-10-16"
    strings:
        $fam_name = "gaofenquming" ascii wide nocase
        $alias_1 = "adware.gaofenquming" ascii wide nocase
        $alias_2 = "hijacker.gaofenquming" ascii wide nocase
        $alias_3 = "pup.gaofenquming" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GAOFENQUMING_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gaofenquming tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gaofenquming"
        date = "2026-10-16"
    strings:
        $attrib_str = "gaofenquming" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Garrun (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/garrun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GARRUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Garrun (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/garrun"
        date = "2026-10-16"
    strings:
        $fam_name = "garrun" ascii wide nocase
        $alias_1 = "trojan:win32/garrun" ascii wide nocase
        $alias_2 = "trojan:win32/garrun.a" ascii wide nocase
        $alias_3 = "backdoor:win32/garrun" ascii wide nocase
        $alias_4 = "win32/garrun" ascii wide nocase
        $alias_5 = "backdoor.garrun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GARRUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Garrun tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/garrun"
        date = "2026-10-16"
    strings:
        $attrib_str = "garrun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Garvi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/garvi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GARVI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Garvi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/garvi"
        date = "2026-10-16"
    strings:
        $fam_name = "garvi" ascii wide nocase
        $alias_1 = "trojan.garvi" ascii wide nocase
        $alias_2 = "downloader.garvi" ascii wide nocase
        $alias_3 = "win32/garvi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GARVI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Garvi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/garvi"
        date = "2026-10-16"
    strings:
        $attrib_str = "garvi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gasti (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gasti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GASTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gasti (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gasti"
        date = "2026-10-16"
    strings:
        $fam_name = "gasti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GASTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gasti tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gasti"
        date = "2026-10-16"
    strings:
        $attrib_str = "gasti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gatak (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gatak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GATAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gatak (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gatak"
        date = "2026-10-16"
    strings:
        $fam_name = "gatak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GATAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gatak tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gatak"
        date = "2026-10-16"
    strings:
        $attrib_str = "gatak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gate (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gate (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gate"
        date = "2026-10-16"
    strings:
        $fam_name = "gate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gate tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gate"
        date = "2026-10-16"
    strings:
        $attrib_str = "gate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gator (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gator (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gator"
        date = "2026-10-16"
    strings:
        $fam_name = "gator" ascii wide nocase
        $alias_1 = "adware:win32/gator" ascii wide nocase
        $alias_2 = "gain" ascii wide nocase
        $alias_3 = "gator advertising and information network" ascii wide nocase
        $alias_4 = "claria.gator" ascii wide nocase
        $alias_5 = "spyware.gator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gator tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gator"
        date = "2026-10-16"
    strings:
        $attrib_str = "gator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gdsda (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gdsda
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GDSDA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gdsda (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gdsda"
        date = "2026-10-16"
    strings:
        $fam_name = "gdsda" ascii wide nocase
        $alias_1 = "trojan.gdsda" ascii wide nocase
        $alias_2 = "downloader.gdsda" ascii wide nocase
        $alias_3 = "win32/gdsda" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GDSDA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gdsda tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gdsda"
        date = "2026-10-16"
    strings:
        $attrib_str = "gdsda" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gemius (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gemius
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GEMIUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gemius (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gemius"
        date = "2026-10-16"
    strings:
        $fam_name = "gemius" ascii wide nocase
        $alias_1 = "riskware.gemius" ascii wide nocase
        $alias_2 = "adware.gemius" ascii wide nocase
        $alias_3 = "pup.tracking.gemius" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GEMIUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gemius tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gemius"
        date = "2026-10-16"
    strings:
        $attrib_str = "gemius" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gena (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gena
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gena (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gena"
        date = "2026-10-16"
    strings:
        $fam_name = "gena" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gena tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gena"
        date = "2026-10-16"
    strings:
        $attrib_str = "gena" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genasep (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genasep
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENASEP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genasep (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genasep"
        date = "2026-10-16"
    strings:
        $fam_name = "genasep" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENASEP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genasep tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genasep"
        date = "2026-10-16"
    strings:
        $attrib_str = "genasep" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genasom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genasom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENASOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genasom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genasom"
        date = "2026-10-16"
    strings:
        $fam_name = "genasom" ascii wide nocase
        $alias_1 = "ransom:win32/genasom" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.genasom" ascii wide nocase
        $alias_3 = "win32/genasom" ascii wide nocase
        $alias_4 = "ransom.genasom" ascii wide nocase
        $alias_5 = "genasom police locker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENASOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genasom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genasom"
        date = "2026-10-16"
    strings:
        $attrib_str = "genasom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gendal (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gendal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENDAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gendal (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gendal"
        date = "2026-10-16"
    strings:
        $fam_name = "gendal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENDAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gendal tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gendal"
        date = "2026-10-16"
    strings:
        $attrib_str = "gendal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gendelfan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gendelfan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENDELFAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gendelfan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gendelfan"
        date = "2026-10-16"
    strings:
        $fam_name = "gendelfan" ascii wide nocase
        $alias_1 = "trojan.gendelfan" ascii wide nocase
        $alias_2 = "downloader.gendelfan" ascii wide nocase
        $alias_3 = "win32/gendelfan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENDELFAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gendelfan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gendelfan"
        date = "2026-10-16"
    strings:
        $attrib_str = "gendelfan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gendwnurl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gendwnurl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENDWNURL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gendwnurl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gendwnurl"
        date = "2026-10-16"
    strings:
        $fam_name = "gendwnurl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENDWNURL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gendwnurl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gendwnurl"
        date = "2026-10-16"
    strings:
        $attrib_str = "gendwnurl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericgb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericgb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICGB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericgb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericgb"
        date = "2026-10-16"
    strings:
        $fam_name = "genericgb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICGB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericgb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericgb"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericgb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Generickdz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/generickdz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICKDZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Generickdz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/generickdz"
        date = "2026-10-16"
    strings:
        $fam_name = "generickdz" ascii wide nocase
        $alias_1 = "ransom:win32/generickdz" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.generickdz" ascii wide nocase
        $alias_3 = "win32/generickdz" ascii wide nocase
        $alias_4 = "generickdz ransomware" ascii wide nocase
        $alias_5 = "ransom.generickdz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICKDZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Generickdz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/generickdz"
        date = "2026-10-16"
    strings:
        $attrib_str = "generickdz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxaa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxaa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxaa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaa"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxaa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxaa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaa"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxaa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxad (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxad (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxad"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxad" ascii wide nocase
        $alias_1 = "adware.generic.rx" ascii wide nocase
        $alias_2 = "pup.generic" ascii wide nocase
        $alias_3 = "win32/adware.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxad tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxad"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxaf (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxaf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxaf (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaf"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxaf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxaf tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaf"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxaf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxal (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxal (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxal"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxal tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxal"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxam (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxam (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxam"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxam tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxam"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxaq (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxaq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxaq (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaq"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxaq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxaq tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaq"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxaq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxas (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxas
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxas (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxas"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxas" ascii wide nocase
        $alias_1 = "trojan.generic.rx" ascii wide nocase
        $alias_2 = "suspicious.generic" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxas tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxas"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxas" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Genericrxat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxat"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxat" ascii wide nocase
        $alias_1 = "trojan.generic" ascii wide nocase
        $alias_2 = "malware.heuristic.gen" ascii wide nocase
        $alias_3 = "win32/trojan.genericrxat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxat"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxau (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxau
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxau (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxau"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxau" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxau tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxau"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxau" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxax (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxax
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxax (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxax"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxax" ascii wide nocase
        $alias_1 = "trojan.generic.genericrxax" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxax tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxax"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxax" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxaz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxaz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXAZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxaz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaz"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxaz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXAZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxaz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaz"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxaz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxbg (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxbg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXBG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxbg (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbg"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxbg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXBG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxbg tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbg"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxbg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Genericrxbm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxbm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXBM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxbm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbm"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxbm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXBM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxbm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbm"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxbm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxbp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxbp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXBP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxbp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbp"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxbp" ascii wide nocase
        $alias_1 = "trojan.genericrxbp" ascii wide nocase
        $alias_2 = "heur.genericrxbp" ascii wide nocase
        $alias_3 = "suspicious.genericrxbp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXBP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxbp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbp"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxbp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxbu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxbu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXBU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxbu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbu"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxbu" ascii wide nocase
        $alias_1 = "trojan.generic.genericrxbu" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXBU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxbu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbu"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxbu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxbw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxbw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXBW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxbw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbw"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxbw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXBW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxbw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbw"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxbw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxbx (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxbx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXBX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxbx (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbx"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxbx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXBX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxbx tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbx"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxbx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxby (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxby
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXBY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxby (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxby"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxby" ascii wide nocase
        $alias_1 = "trojan.generic.rx" ascii wide nocase
        $alias_2 = "suspicious.generic" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXBY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxby tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxby"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxby" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Genericrxbz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxbz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXBZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxbz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbz"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxbz" ascii wide nocase
        $alias_1 = "trojan.generic.genericrxbz" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXBZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxbz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbz"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxbz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxca (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxca
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxca (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxca"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxca" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxca tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxca"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxca" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxcd (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcd (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcd"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcd" ascii wide nocase
        $alias_1 = "trojan.generic" ascii wide nocase
        $alias_2 = "malware.heuristic.gen" ascii wide nocase
        $alias_3 = "win32/trojan.genericrxcd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcd tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcd"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxce (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxce
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxce (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxce"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxce" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxce tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxce"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxce" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Genericrxcf (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcf (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcf"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcf" ascii wide nocase
        $alias_1 = "trojan.genericrxcf" ascii wide nocase
        $alias_2 = "malware.generic.rxcf" ascii wide nocase
        $alias_3 = "suspicious.dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcf tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcf"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxcg (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcg (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcg"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcg" ascii wide nocase
        $alias_1 = "trojan.generic.rx" ascii wide nocase
        $alias_2 = "suspicious.generic" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcg tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcg"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Genericrxch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxch"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxch" ascii wide nocase
        $alias_1 = "trojan.genericrxch" ascii wide nocase
        $alias_2 = "heur:trojan.win32.generic" ascii wide nocase
        $alias_3 = "suspicious.rxch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxch"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxci (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxci
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxci (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxci"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxci" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxci tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxci"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxci" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxck (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxck
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxck (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxck"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxck" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxck tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxck"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxck" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxcl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcl"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcl"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxcp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcp"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcp"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxcr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcr"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcr" ascii wide nocase
        $alias_1 = "trojan.genericrxcr" ascii wide nocase
        $alias_2 = "malware.generic.rxcr" ascii wide nocase
        $alias_3 = "suspicious.dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcr"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxcs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcs"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcs" ascii wide nocase
        $alias_1 = "trojan.genericrxcs" ascii wide nocase
        $alias_2 = "heur:trojan.win32.generic" ascii wide nocase
        $alias_3 = "suspicious.genericrxcs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcs"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxcu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcu"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcu" ascii wide nocase
        $alias_1 = "trojan.genericrxcu" ascii wide nocase
        $alias_2 = "malware.generic.rxcu" ascii wide nocase
        $alias_3 = "suspicious.dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcu"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxcv (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcv (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcv"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcv" ascii wide nocase
        $alias_1 = "trojan.genericrxcv" ascii wide nocase
        $alias_2 = "malware.generic.rxcv" ascii wide nocase
        $alias_3 = "suspicious.dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcv tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcv"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxcw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcw"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcw"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxcy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxcy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXCY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxcy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcy"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxcy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXCY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxcy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcy"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxcy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxda (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxda
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxda (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxda"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxda" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxda tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxda"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxda" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxdc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxdc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxdc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdc"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxdc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxdc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdc"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxdc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxde (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxde
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxde (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxde"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxde" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxde tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxde"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxde" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxdf (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxdf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxdf (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdf"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxdf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxdf tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdf"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxdf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxdi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxdi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxdi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdi"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxdi" ascii wide nocase
        $alias_1 = "trojan.genericrxdi" ascii wide nocase
        $alias_2 = "heur.genericrxdi" ascii wide nocase
        $alias_3 = "suspicious.genericrxdi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxdi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdi"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxdi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxdm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxdm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxdm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdm"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxdm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxdm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdm"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxdm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxdr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxdr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxdr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdr"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxdr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxdr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdr"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxdr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxdt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxdt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxdt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdt"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxdt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxdt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdt"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxdt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxdw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxdw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxdw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdw"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxdw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxdw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdw"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxdw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxdx (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxdx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxdx (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdx"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxdx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxdx tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdx"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxdx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxdz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxdz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXDZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxdz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdz"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxdz" ascii wide nocase
        $alias_1 = "ransom:win32/genericrxdz" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.genericrxdz" ascii wide nocase
        $alias_3 = "win32/genericrxdz" ascii wide nocase
        $alias_4 = "genericrxdz ransomware" ascii wide nocase
        $alias_5 = "ransom.genericrxdz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXDZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxdz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdz"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxdz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxea (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxea
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxea (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxea"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxea" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxea tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxea"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxea" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxeb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxeb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxeb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeb"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxeb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxeb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeb"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxeb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxed (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxed
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxed (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxed"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxed" ascii wide nocase
        $alias_1 = "trojan.genericrxed" ascii wide nocase
        $alias_2 = "heur.genericrxed" ascii wide nocase
        $alias_3 = "suspicious.genericrxed" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxed tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxed"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxed" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxef (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxef
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxef (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxef"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxef" ascii wide nocase
        $alias_1 = "trojan.genericrxef" ascii wide nocase
        $alias_2 = "malware.generic.rxef" ascii wide nocase
        $alias_3 = "suspicious.dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxef tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxef"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxef" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxeg (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxeg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxeg (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeg"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxeg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxeg tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeg"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxeg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxeh (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxeh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxeh (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeh"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxeh" ascii wide nocase
        $alias_1 = "trojan.genericrxeh" ascii wide nocase
        $alias_2 = "heur.genericrxeh" ascii wide nocase
        $alias_3 = "suspicious.genericrxeh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxeh tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeh"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxeh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxel"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxel" ascii wide nocase
        $alias_1 = "trojan.generic.genericrxel" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxel"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxen (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxen (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxen"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxen tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxen"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxeo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxeo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxeo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeo"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxeo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxeo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeo"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxeo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxep (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxep
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxep (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxep"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxep" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxep tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxep"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxep" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxeq (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxeq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxeq (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeq"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxeq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxeq tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeq"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxeq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxer"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxer"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxet"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxet" ascii wide nocase
        $alias_1 = "ransomware.genericrxet" ascii wide nocase
        $alias_2 = "trojan.heur.genericrxet" ascii wide nocase
        $alias_3 = "win32/genericrxet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxet"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxev (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxev
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxev (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxev"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxev" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxev tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxev"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxev" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxew (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxew
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxew (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxew"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxew" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxew tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxew"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxew" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxex"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxex" ascii wide nocase
        $alias_1 = "trojan.genericrxex" ascii wide nocase
        $alias_2 = "heur.genericrxex" ascii wide nocase
        $alias_3 = "riskware.generic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxex"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxfe (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxfe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxfe (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfe"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxfe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxfe tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfe"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxfe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxfh (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxfh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxfh (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfh"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxfh" ascii wide nocase
        $alias_1 = "trojan.genericrxfh" ascii wide nocase
        $alias_2 = "heur.genericrxfh" ascii wide nocase
        $alias_3 = "suspicious.genericrxfh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxfh tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfh"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxfh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxfj (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxfj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxfj (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfj"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxfj" ascii wide nocase
        $alias_1 = "trojan.generic.rx" ascii wide nocase
        $alias_2 = "suspicious.generic" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxfj tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfj"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxfj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Genericrxfo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxfo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxfo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfo"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxfo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxfo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfo"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxfo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxfp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxfp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxfp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfp"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxfp" ascii wide nocase
        $alias_1 = "trojan.genericrxfp" ascii wide nocase
        $alias_2 = "heur.genericrxfp" ascii wide nocase
        $alias_3 = "suspicious.genericrxfp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxfp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfp"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxfp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxfq (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxfq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxfq (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfq"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxfq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxfq tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfq"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxfq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxfs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxfs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxfs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfs"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxfs" ascii wide nocase
        $alias_1 = "trojan.genericrxfs" ascii wide nocase
        $alias_2 = "heur.genericrxfs" ascii wide nocase
        $alias_3 = "suspicious.genericrxfs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxfs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfs"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxfs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxft (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxft
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxft (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxft"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxft" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxft tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxft"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxft" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxfu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxfu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxfu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfu"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxfu" ascii wide nocase
        $alias_1 = "trojan.genericrxfu" ascii wide nocase
        $alias_2 = "heur.genericrxfu" ascii wide nocase
        $alias_3 = "suspicious.genericrxfu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxfu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfu"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxfu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxfv (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxfv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxfv (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfv"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxfv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxfv tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfv"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxfv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxfy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxfy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXFY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxfy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfy"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxfy" ascii wide nocase
        $alias_1 = "trojan.generic.rx" ascii wide nocase
        $alias_2 = "suspicious.generic" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXFY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxfy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfy"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxfy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Genericrxgb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxgb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxgb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgb"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxgb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxgb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgb"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxgb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxge (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxge
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxge (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxge"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxge" ascii wide nocase
        $alias_1 = "trojan.generic.rx" ascii wide nocase
        $alias_2 = "suspicious.generic" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxge tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxge"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxge" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Genericrxgf (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxgf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxgf (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgf"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxgf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxgf tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgf"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxgf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxgh (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxgh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxgh (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgh"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxgh" ascii wide nocase
        $alias_1 = "trojan.generic.rx" ascii wide nocase
        $alias_2 = "suspicious.generic" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxgh tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgh"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxgh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Genericrxgj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxgj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxgj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgj"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxgj" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxgj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgj"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxgj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxgk (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxgk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxgk (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgk"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxgk" ascii wide nocase
        $alias_1 = "trojan.generic.genericrxgk" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxgk tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgk"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxgk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxgl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxgl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxgl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgl"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxgl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxgl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgl"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxgl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxgm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxgm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxgm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgm"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxgm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxgm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgm"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxgm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxgp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxgp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxgp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgp"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxgp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxgp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgp"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxgp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxgq (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxgq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxgq (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgq"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxgq" ascii wide nocase
        $alias_1 = "trojan.genericrxgq" ascii wide nocase
        $alias_2 = "heur:trojan.win32.generic" ascii wide nocase
        $alias_3 = "suspicious.genericrxgq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxgq tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgq"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxgq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genericrxgr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genericrxgr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICRXGR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genericrxgr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgr"
        date = "2026-10-16"
    strings:
        $fam_name = "genericrxgr" ascii wide nocase
        $alias_1 = "trojan.genericrxgr" ascii wide nocase
        $alias_2 = "heur:trojan.win32.generic" ascii wide nocase
        $alias_3 = "suspicious.rxgr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICRXGR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genericrxgr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgr"
        date = "2026-10-16"
    strings:
        $attrib_str = "genericrxgr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Generictka (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/generictka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENERICTKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Generictka (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/generictka"
        date = "2026-10-16"
    strings:
        $fam_name = "generictka" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENERICTKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Generictka tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/generictka"
        date = "2026-10-16"
    strings:
        $attrib_str = "generictka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Geni (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/geni
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Geni (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/geni"
        date = "2026-10-16"
    strings:
        $fam_name = "geni" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Geni tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/geni"
        date = "2026-10-16"
    strings:
        $attrib_str = "geni" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genkmsp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genkmsp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENKMSP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genkmsp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genkmsp"
        date = "2026-10-16"
    strings:
        $fam_name = "genkmsp" ascii wide nocase
        $alias_1 = "hacktool.kmsauto" ascii wide nocase
        $alias_2 = "riskware.kmspico" ascii wide nocase
        $alias_3 = "w32/autokms" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENKMSP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genkmsp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genkmsp"
        date = "2026-10-16"
    strings:
        $attrib_str = "genkmsp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genkryptik (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genkryptik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENKRYPTIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genkryptik (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genkryptik"
        date = "2026-10-16"
    strings:
        $fam_name = "genkryptik" ascii wide nocase
        $alias_1 = "trojan:win32/genkryptik" ascii wide nocase
        $alias_2 = "packer:win32/kryptik" ascii wide nocase
        $alias_3 = "trojan.genkryptik" ascii wide nocase
        $alias_4 = "win32/kryptik.packer" ascii wide nocase
        $alias_5 = "crypter.genkryptik" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENKRYPTIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genkryptik tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genkryptik"
        date = "2026-10-16"
    strings:
        $attrib_str = "genkryptik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Genmaldow (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genmaldow
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENMALDOW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genmaldow (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genmaldow"
        date = "2026-10-16"
    strings:
        $fam_name = "genmaldow" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENMALDOW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genmaldow tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genmaldow"
        date = "2026-10-16"
    strings:
        $attrib_str = "genmaldow" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gentromal (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gentromal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENTROMAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gentromal (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gentromal"
        date = "2026-10-16"
    strings:
        $fam_name = "gentromal" ascii wide nocase
        $alias_1 = "trojan.gentromal" ascii wide nocase
        $alias_2 = "heur:trojan.win32.generic" ascii wide nocase
        $alias_3 = "suspicious.gentromal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENTROMAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gentromal tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gentromal"
        date = "2026-10-16"
    strings:
        $attrib_str = "gentromal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Genx (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/genx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GENX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Genx (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genx"
        date = "2026-10-16"
    strings:
        $fam_name = "genx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GENX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Genx tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/genx"
        date = "2026-10-16"
    strings:
        $attrib_str = "genx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gepys (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gepys
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GEPYS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gepys (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gepys"
        date = "2026-10-16"
    strings:
        $fam_name = "gepys" ascii wide nocase
        $alias_1 = "gepys" ascii wide nocase
        $alias_2 = "trojan:win32/gepys" ascii wide nocase
        $alias_3 = "downloader.gepys" ascii wide nocase
        $alias_4 = "trojan.gepys" ascii wide nocase
        $alias_5 = "win32/gepys" ascii wide nocase
        $alias_6 = "gepys loader" ascii wide nocase
        $alias_7 = "trojan:win32/gepys.dsb!mtb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GEPYS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gepys tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gepys"
        date = "2026-10-16"
    strings:
        $attrib_str = "gepys" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Geral (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/geral
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GERAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Geral (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/geral"
        date = "2026-10-16"
    strings:
        $fam_name = "geral" ascii wide nocase
        $alias_1 = "ransom:win32/geral" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.geral" ascii wide nocase
        $alias_3 = "win32/geral" ascii wide nocase
        $alias_4 = "geral ransomware" ascii wide nocase
        $alias_5 = "ransom.geral" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GERAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Geral tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/geral"
        date = "2026-10-16"
    strings:
        $attrib_str = "geral" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Getnow (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/getnow
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GETNOW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Getnow (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/getnow"
        date = "2026-10-16"
    strings:
        $fam_name = "getnow" ascii wide nocase
        $alias_1 = "adware.getnow" ascii wide nocase
        $alias_2 = "pup.getnow" ascii wide nocase
        $alias_3 = "downloader.getnow" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GETNOW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Getnow tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/getnow"
        date = "2026-10-16"
    strings:
        $attrib_str = "getnow" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ggdoor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ggdoor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GGDOOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ggdoor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ggdoor"
        date = "2026-10-16"
    strings:
        $fam_name = "ggdoor" ascii wide nocase
        $alias_1 = "backdoor.ggdoor" ascii wide nocase
        $alias_2 = "trojan.ggdoor" ascii wide nocase
        $alias_3 = "win32/ggdoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GGDOOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ggdoor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ggdoor"
        date = "2026-10-16"
    strings:
        $attrib_str = "ggdoor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ggpass (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ggpass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GGPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ggpass (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ggpass"
        date = "2026-10-16"
    strings:
        $fam_name = "ggpass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GGPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ggpass tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ggpass"
        date = "2026-10-16"
    strings:
        $attrib_str = "ggpass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gh0St (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gh0st
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GH0ST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gh0St (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gh0st"
        date = "2026-10-16"
    strings:
        $fam_name = "gh0st" ascii wide nocase
        $alias_1 = "gh0st rat" ascii wide nocase
        $alias_2 = "backdoor.gh0st" ascii wide nocase
        $alias_3 = "win32/gh0st" ascii wide nocase
        $alias_4 = "ghost rat" ascii wide nocase
        $alias_5 = "trojan.win32.gh0st" ascii wide nocase
        $alias_6 = "gh0st.c.rufus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GH0ST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gh0St tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gh0st"
        date = "2026-10-16"
    strings:
        $attrib_str = "gh0st" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Ghost (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ghost
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GHOST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ghost (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ghost"
        date = "2026-10-16"
    strings:
        $fam_name = "ghost" ascii wide nocase
        $alias_1 = "gh0st rat" ascii wide nocase
        $alias_2 = "gh0st" ascii wide nocase
        $alias_3 = "ghostrat" ascii wide nocase
        $alias_4 = "backdoor.gh0st" ascii wide nocase
        $alias_5 = "win32/ghost" ascii wide nocase
        $alias_6 = "trojan.ghostrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GHOST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ghost tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ghost"
        date = "2026-10-16"
    strings:
        $attrib_str = "ghost" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Ghoul (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ghoul
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GHOUL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ghoul (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ghoul"
        date = "2026-10-16"
    strings:
        $fam_name = "ghoul" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GHOUL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ghoul tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ghoul"
        date = "2026-10-16"
    strings:
        $attrib_str = "ghoul" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gibe (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gibe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GIBE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gibe (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gibe"
        date = "2026-10-16"
    strings:
        $fam_name = "gibe" ascii wide nocase
        $alias_1 = "w32.gibe" ascii wide nocase
        $alias_2 = "worm:win32/gibe" ascii wide nocase
        $alias_3 = "worm.swen" ascii wide nocase
        $alias_4 = "i-worm.gibe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GIBE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gibe tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gibe"
        date = "2026-10-16"
    strings:
        $attrib_str = "gibe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gify (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gify
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GIFY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gify (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gify"
        date = "2026-10-16"
    strings:
        $fam_name = "gify" ascii wide nocase
        $alias_1 = "trojandownloader:win32/gify" ascii wide nocase
        $alias_2 = "trojan:win32/gify" ascii wide nocase
        $alias_3 = "trojan.gify" ascii wide nocase
        $alias_4 = "win32/gify" ascii wide nocase
        $alias_5 = "trojan-downloader.win32.gify.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GIFY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gify tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gify"
        date = "2026-10-16"
    strings:
        $attrib_str = "gify" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gimemo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gimemo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GIMEMO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gimemo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gimemo"
        date = "2026-10-16"
    strings:
        $fam_name = "gimemo" ascii wide nocase
        $alias_1 = "ransom:win32/gimemo" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.gimemo" ascii wide nocase
        $alias_3 = "trojan.gimemo" ascii wide nocase
        $alias_4 = "win32/gimemo" ascii wide nocase
        $alias_5 = "ransom:win32/gimemo.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GIMEMO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gimemo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gimemo"
        date = "2026-10-16"
    strings:
        $attrib_str = "gimemo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gippers (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gippers
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GIPPERS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gippers (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gippers"
        date = "2026-10-16"
    strings:
        $fam_name = "gippers" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GIPPERS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gippers tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gippers"
        date = "2026-10-16"
    strings:
        $attrib_str = "gippers" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Giri (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/giri
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GIRI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Giri (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/giri"
        date = "2026-10-16"
    strings:
        $fam_name = "giri" ascii wide nocase
        $alias_1 = "trojan.giri" ascii wide nocase
        $alias_2 = "downloader.giri" ascii wide nocase
        $alias_3 = "win32/giri" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GIRI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Giri tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/giri"
        date = "2026-10-16"
    strings:
        $attrib_str = "giri" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gjue (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gjue
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GJUE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gjue (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gjue"
        date = "2026-10-16"
    strings:
        $fam_name = "gjue" ascii wide nocase
        $alias_1 = "adware:win32/gjue" ascii wide nocase
        $alias_2 = "pua:win32/gjue" ascii wide nocase
        $alias_3 = "adware.gjue" ascii wide nocase
        $alias_4 = "win32/gjue" ascii wide nocase
        $alias_5 = "adware:win32/gjue.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GJUE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gjue tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gjue"
        date = "2026-10-16"
    strings:
        $attrib_str = "gjue" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Globalacces (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/globalacces
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GLOBALACCES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Globalacces (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/globalacces"
        date = "2026-10-16"
    strings:
        $fam_name = "globalacces" ascii wide nocase
        $alias_1 = "adware.globalacces" ascii wide nocase
        $alias_2 = "pup.globalaccess" ascii wide nocase
        $alias_3 = "browsermodifier:win32/globalacces" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GLOBALACCES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Globalacces tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/globalacces"
        date = "2026-10-16"
    strings:
        $attrib_str = "globalacces" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Globalupdate (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/globalupdate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GLOBALUPDATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Globalupdate (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/globalupdate"
        date = "2026-10-16"
    strings:
        $fam_name = "globalupdate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GLOBALUPDATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Globalupdate tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/globalupdate"
        date = "2026-10-16"
    strings:
        $attrib_str = "globalupdate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Globeimposter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/globeimposter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GLOBEIMPOSTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Globeimposter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/globeimposter"
        date = "2026-10-16"
    strings:
        $fam_name = "globeimposter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GLOBEIMPOSTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Globeimposter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/globeimposter"
        date = "2026-10-16"
    strings:
        $attrib_str = "globeimposter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Globim (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/globim
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GLOBIM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Globim (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/globim"
        date = "2026-10-16"
    strings:
        $fam_name = "globim" ascii wide nocase
        $alias_1 = "trojan.globim" ascii wide nocase
        $alias_2 = "downloader.globim" ascii wide nocase
        $alias_3 = "win32/globim" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GLOBIM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Globim tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/globim"
        date = "2026-10-16"
    strings:
        $attrib_str = "globim" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Glox (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/glox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GLOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Glox (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/glox"
        date = "2026-10-16"
    strings:
        $fam_name = "glox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GLOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Glox tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/glox"
        date = "2026-10-16"
    strings:
        $attrib_str = "glox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Glukelira (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/glukelira
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GLUKELIRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Glukelira (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/glukelira"
        date = "2026-10-16"
    strings:
        $fam_name = "glukelira" ascii wide nocase
        $alias_1 = "adware.glukelira" ascii wide nocase
        $alias_2 = "pup.glukelira" ascii wide nocase
        $alias_3 = "browsermodifier:win32/glukelira" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GLUKELIRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Glukelira tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/glukelira"
        date = "2026-10-16"
    strings:
        $attrib_str = "glukelira" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Glupteba (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/glupteba
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GLUPTEBA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Glupteba (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/glupteba"
        date = "2026-10-16"
    strings:
        $fam_name = "glupteba" ascii wide nocase
        $alias_1 = "trojan:win32/glupteba" ascii wide nocase
        $alias_2 = "backdoor:win32/glupteba" ascii wide nocase
        $alias_3 = "win32/glupteba" ascii wide nocase
        $alias_4 = "trojan.glupteba" ascii wide nocase
        $alias_5 = "glupteba botnet" ascii wide nocase
        $alias_6 = "backdoor.win32.glupteba" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GLUPTEBA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Glupteba tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/glupteba"
        date = "2026-10-16"
    strings:
        $attrib_str = "glupteba" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Goabeny (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/goabeny
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOABENY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Goabeny (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goabeny"
        date = "2026-10-16"
    strings:
        $fam_name = "goabeny" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOABENY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Goabeny tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goabeny"
        date = "2026-10-16"
    strings:
        $attrib_str = "goabeny" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gobot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gobot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gobot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gobot"
        date = "2026-10-16"
    strings:
        $fam_name = "gobot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gobot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gobot"
        date = "2026-10-16"
    strings:
        $attrib_str = "gobot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gocloudnet (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gocloudnet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOCLOUDNET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gocloudnet (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gocloudnet"
        date = "2026-10-16"
    strings:
        $fam_name = "gocloudnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOCLOUDNET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gocloudnet tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gocloudnet"
        date = "2026-10-16"
    strings:
        $attrib_str = "gocloudnet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Godzilla (Webshell)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/godzilla
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GODZILLA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Godzilla (Webshell)"
        category = "Webshell"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/godzilla"
        date = "2026-10-16"
    strings:
        $fam_name = "godzilla" ascii wide nocase
        $alias_1 = "backdoor:java/godzilla" ascii wide nocase
        $alias_2 = "backdoor:asp/godzilla" ascii wide nocase
        $alias_3 = "backdoor:php/godzilla" ascii wide nocase
        $alias_4 = "godzilla webshell" ascii wide nocase
        $alias_5 = "trojan:win32/godzilla" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GODZILLA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Godzilla tradecraft"
        category = "Webshell"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/godzilla"
        date = "2026-10-16"
    strings:
        $attrib_str = "godzilla" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gofot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gofot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOFOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gofot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gofot"
        date = "2026-10-16"
    strings:
        $fam_name = "gofot" ascii wide nocase
        $alias_1 = "trojandownloader:win32/gofot" ascii wide nocase
        $alias_2 = "trojan:win32/gofot.a" ascii wide nocase
        $alias_3 = "trojan.win32.gofot" ascii wide nocase
        $alias_4 = "win32/gofot" ascii wide nocase
        $alias_5 = "trojan.gofot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOFOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gofot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gofot"
        date = "2026-10-16"
    strings:
        $attrib_str = "gofot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gojdu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gojdu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOJDU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gojdu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gojdu"
        date = "2026-10-16"
    strings:
        $fam_name = "gojdu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOJDU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gojdu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gojdu"
        date = "2026-10-16"
    strings:
        $attrib_str = "gojdu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gojdue (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gojdue
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOJDUE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gojdue (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gojdue"
        date = "2026-10-16"
    strings:
        $fam_name = "gojdue" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOJDUE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gojdue tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gojdue"
        date = "2026-10-16"
    strings:
        $attrib_str = "gojdue" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Goldun (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/goldun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOLDUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Goldun (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goldun"
        date = "2026-10-16"
    strings:
        $fam_name = "goldun" ascii wide nocase
        $alias_1 = "trojan.goldun" ascii wide nocase
        $alias_2 = "banker.goldun" ascii wide nocase
        $alias_3 = "win32/spy.goldun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOLDUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Goldun tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goldun"
        date = "2026-10-16"
    strings:
        $attrib_str = "goldun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Golem (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/golem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOLEM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Golem (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/golem"
        date = "2026-10-16"
    strings:
        $fam_name = "golem" ascii wide nocase
        $alias_1 = "trojan.golem" ascii wide nocase
        $alias_2 = "rootkit.golem" ascii wide nocase
        $alias_3 = "botnet.golem" ascii wide nocase
        $alias_4 = "win32/golem" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOLEM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Golem tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/golem"
        date = "2026-10-16"
    strings:
        $attrib_str = "golem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Golroted (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/golroted
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOLROTED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Golroted (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/golroted"
        date = "2026-10-16"
    strings:
        $fam_name = "golroted" ascii wide nocase
        $alias_1 = "ransom:win32/golroted" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.golroted" ascii wide nocase
        $alias_3 = "win32/golroted" ascii wide nocase
        $alias_4 = "ransom.golroted" ascii wide nocase
        $alias_5 = "ransom:win32/golroted.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOLROTED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Golroted tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/golroted"
        date = "2026-10-16"
    strings:
        $attrib_str = "golroted" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Goobzo (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/goobzo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOOBZO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Goobzo (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goobzo"
        date = "2026-10-16"
    strings:
        $fam_name = "goobzo" ascii wide nocase
        $alias_1 = "adware.goobzo" ascii wide nocase
        $alias_2 = "pup.goobzo" ascii wide nocase
        $alias_3 = "browsermodifier.goobzo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOOBZO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Goobzo tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goobzo"
        date = "2026-10-16"
    strings:
        $attrib_str = "goobzo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Goodpic (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/goodpic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOODPIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Goodpic (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goodpic"
        date = "2026-10-16"
    strings:
        $fam_name = "goodpic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOODPIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Goodpic tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goodpic"
        date = "2026-10-16"
    strings:
        $attrib_str = "goodpic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Google (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/google
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOOGLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Google (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/google"
        date = "2026-10-16"
    strings:
        $fam_name = "google" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOOGLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Google tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/google"
        date = "2026-10-16"
    strings:
        $attrib_str = "google" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gootkit (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gootkit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOOTKIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gootkit (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gootkit"
        date = "2026-10-16"
    strings:
        $fam_name = "gootkit" ascii wide nocase
        $alias_1 = "trojan:win32/gootkit" ascii wide nocase
        $alias_2 = "trojan.gootkit" ascii wide nocase
        $alias_3 = "gootloader" ascii wide nocase
        $alias_4 = "win32/gootkit" ascii wide nocase
        $alias_5 = "gootkit banking trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOOTKIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gootkit tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gootkit"
        date = "2026-10-16"
    strings:
        $attrib_str = "gootkit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Goppel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/goppel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOPPEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Goppel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goppel"
        date = "2026-10-16"
    strings:
        $fam_name = "goppel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOPPEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Goppel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goppel"
        date = "2026-10-16"
    strings:
        $attrib_str = "goppel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gorgon (Apt)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gorgon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GORGON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gorgon (Apt)"
        category = "Apt"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gorgon"
        date = "2026-10-16"
    strings:
        $fam_name = "gorgon" ascii wide nocase
        $alias_1 = "trojan:win32/gorgon" ascii wide nocase
        $alias_2 = "backdoor:win32/gorgon" ascii wide nocase
        $alias_3 = "the gorgon group" ascii wide nocase
        $alias_4 = "gorgon apt" ascii wide nocase
        $alias_5 = "win32/gorgon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GORGON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gorgon tradecraft"
        category = "Apt"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gorgon"
        date = "2026-10-16"
    strings:
        $attrib_str = "gorgon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gorillaprice (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gorillaprice
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GORILLAPRICE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gorillaprice (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gorillaprice"
        date = "2026-10-16"
    strings:
        $fam_name = "gorillaprice" ascii wide nocase
        $alias_1 = "adware:win32/gorillaprice" ascii wide nocase
        $alias_2 = "pua:win32/gorillaprice" ascii wide nocase
        $alias_3 = "pup.optional.gorillaprice" ascii wide nocase
        $alias_4 = "adware.gorillaprice" ascii wide nocase
        $alias_5 = "win32/gorillaprice" ascii wide nocase
        $alias_6 = "gorillaprice shopping assistant" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GORILLAPRICE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gorillaprice tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gorillaprice"
        date = "2026-10-16"
    strings:
        $attrib_str = "gorillaprice" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gosys (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gosys
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOSYS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gosys (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gosys"
        date = "2026-10-16"
    strings:
        $fam_name = "gosys" ascii wide nocase
        $alias_1 = "trojan.gosys" ascii wide nocase
        $alias_2 = "downloader.gosys" ascii wide nocase
        $alias_3 = "win32/gosys" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOSYS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gosys tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gosys"
        date = "2026-10-16"
    strings:
        $attrib_str = "gosys" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gotango (Browser_Modifier)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gotango
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOTANGO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gotango (Browser_Modifier)"
        category = "Browser_Modifier"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gotango"
        date = "2026-10-16"
    strings:
        $fam_name = "gotango" ascii wide nocase
        $alias_1 = "browsermodifier:win32/gotango" ascii wide nocase
        $alias_2 = "adware:win32/gotango" ascii wide nocase
        $alias_3 = "pua:win32/gotango" ascii wide nocase
        $alias_4 = "gotango toolbar" ascii wide nocase
        $alias_5 = "win32/gotango" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOTANGO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gotango tradecraft"
        category = "Browser_Modifier"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gotango"
        date = "2026-10-16"
    strings:
        $attrib_str = "gotango" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gottle (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gottle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOTTLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gottle (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gottle"
        date = "2026-10-16"
    strings:
        $fam_name = "gottle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOTTLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gottle tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gottle"
        date = "2026-10-16"
    strings:
        $attrib_str = "gottle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gozi (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gozi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOZI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gozi (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gozi"
        date = "2026-10-16"
    strings:
        $fam_name = "gozi" ascii wide nocase
        $alias_1 = "gozi" ascii wide nocase
        $alias_2 = "isfb" ascii wide nocase
        $alias_3 = "ursnif" ascii wide nocase
        $alias_4 = "trojan.gozi" ascii wide nocase
        $alias_5 = "win32/gozi" ascii wide nocase
        $alias_6 = "gozi-isfb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOZI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gozi tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gozi"
        date = "2026-10-16"
    strings:
        $attrib_str = "gozi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Goznym (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/goznym
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GOZNYM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Goznym (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goznym"
        date = "2026-10-16"
    strings:
        $fam_name = "goznym" ascii wide nocase
        $alias_1 = "goznym" ascii wide nocase
        $alias_2 = "win32/goznym" ascii wide nocase
        $alias_3 = "trojan-banker.goznym" ascii wide nocase
        $alias_4 = "goznym hybrid" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GOZNYM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Goznym tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/goznym"
        date = "2026-10-16"
    strings:
        $attrib_str = "goznym" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gplyra (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gplyra
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GPLYRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gplyra (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gplyra"
        date = "2026-10-16"
    strings:
        $fam_name = "gplyra" ascii wide nocase
        $alias_1 = "trojan.gplyra" ascii wide nocase
        $alias_2 = "downloader.gplyra" ascii wide nocase
        $alias_3 = "win32/gplyra" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GPLYRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gplyra tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gplyra"
        date = "2026-10-16"
    strings:
        $attrib_str = "gplyra" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gpukj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gpukj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GPUKJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gpukj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gpukj"
        date = "2026-10-16"
    strings:
        $fam_name = "gpukj" ascii wide nocase
        $alias_1 = "trojan.gpukj" ascii wide nocase
        $alias_2 = "downloader.gpukj" ascii wide nocase
        $alias_3 = "win32/gpukj" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GPUKJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gpukj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gpukj"
        date = "2026-10-16"
    strings:
        $attrib_str = "gpukj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Gracewire (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gracewire
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GRACEWIRE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gracewire (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gracewire"
        date = "2026-10-16"
    strings:
        $fam_name = "gracewire" ascii wide nocase
        $alias_1 = "trojan.gracewire" ascii wide nocase
        $alias_2 = "backdoor.gracewire" ascii wide nocase
        $alias_3 = "win32/gracewire" ascii wide nocase
        $alias_4 = "ta505.payload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GRACEWIRE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gracewire tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gracewire"
        date = "2026-10-16"
    strings:
        $attrib_str = "gracewire" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Grandcrab (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/grandcrab
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GRANDCRAB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Grandcrab (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/grandcrab"
        date = "2026-10-16"
    strings:
        $fam_name = "grandcrab" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GRANDCRAB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Grandcrab tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/grandcrab"
        date = "2026-10-16"
    strings:
        $attrib_str = "grandcrab" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Grandcrap (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/grandcrap
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GRANDCRAP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Grandcrap (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/grandcrap"
        date = "2026-10-16"
    strings:
        $fam_name = "grandcrap" ascii wide nocase
        $alias_1 = "ransomware.gandcrab" ascii wide nocase
        $alias_2 = "ransom.grandcrap" ascii wide nocase
        $alias_3 = "win32/gandcrab" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GRANDCRAP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Grandcrap tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/grandcrap"
        date = "2026-10-16"
    strings:
        $attrib_str = "grandcrap" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Graybird (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/graybird
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GRAYBIRD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Graybird (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/graybird"
        date = "2026-10-16"
    strings:
        $fam_name = "graybird" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GRAYBIRD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Graybird tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/graybird"
        date = "2026-10-16"
    strings:
        $attrib_str = "graybird" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Graz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/graz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GRAZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Graz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/graz"
        date = "2026-10-16"
    strings:
        $fam_name = "graz" ascii wide nocase
        $alias_1 = "trojan.graz" ascii wide nocase
        $alias_2 = "downloader.graz" ascii wide nocase
        $alias_3 = "win32/graz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GRAZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Graz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/graz"
        date = "2026-10-16"
    strings:
        $attrib_str = "graz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Grenam (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/grenam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GRENAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Grenam (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/grenam"
        date = "2026-10-16"
    strings:
        $fam_name = "grenam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GRENAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Grenam tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/grenam"
        date = "2026-10-16"
    strings:
        $attrib_str = "grenam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gruel (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gruel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GRUEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gruel (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gruel"
        date = "2026-10-16"
    strings:
        $fam_name = "gruel" ascii wide nocase
        $alias_1 = "worm.gruel" ascii wide nocase
        $alias_2 = "joke.gruel" ascii wide nocase
        $alias_3 = "w32/gruel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GRUEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gruel tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gruel"
        date = "2026-10-16"
    strings:
        $attrib_str = "gruel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gt32Supportgeeks (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gt32supportgeeks
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GT32SUPPORTGEEKS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gt32Supportgeeks (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gt32supportgeeks"
        date = "2026-10-16"
    strings:
        $fam_name = "gt32supportgeeks" ascii wide nocase
        $alias_1 = "pua:win32/gt32supportgeeks" ascii wide nocase
        $alias_2 = "rogue:win32/gt32supportgeeks" ascii wide nocase
        $alias_3 = "program:win32/gt32supportgeeks" ascii wide nocase
        $alias_4 = "win32/gt32supportgeeks" ascii wide nocase
        $alias_5 = "scareware.gt32supportgeeks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GT32SUPPORTGEEKS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gt32Supportgeeks tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gt32supportgeeks"
        date = "2026-10-16"
    strings:
        $attrib_str = "gt32supportgeeks" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Gtbot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gtbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GTBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gtbot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gtbot"
        date = "2026-10-16"
    strings:
        $fam_name = "gtbot" ascii wide nocase
        $alias_1 = "backdoor.irc.gtbot" ascii wide nocase
        $alias_2 = "trojan.gtbot" ascii wide nocase
        $alias_3 = "win32/gtbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GTBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gtbot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gtbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "gtbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Guagua (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/guagua
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GUAGUA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Guagua (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/guagua"
        date = "2026-10-16"
    strings:
        $fam_name = "guagua" ascii wide nocase
        $alias_1 = "trojan:win32/guagua" ascii wide nocase
        $alias_2 = "trojan:win32/guagua.a" ascii wide nocase
        $alias_3 = "backdoor:win32/guagua" ascii wide nocase
        $alias_4 = "win32/guagua" ascii wide nocase
        $alias_5 = "backdoor.guagua" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GUAGUA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Guagua tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/guagua"
        date = "2026-10-16"
    strings:
        $attrib_str = "guagua" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Guildma (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/guildma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GUILDMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Guildma (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/guildma"
        date = "2026-10-16"
    strings:
        $fam_name = "guildma" ascii wide nocase
        $alias_1 = "trojan:win32/guildma" ascii wide nocase
        $alias_2 = "astaroth" ascii wide nocase
        $alias_3 = "guildma" ascii wide nocase
        $alias_4 = "trojan-banker.win32.guildma" ascii wide nocase
        $alias_5 = "win32/guildma" ascii wide nocase
        $alias_6 = "tetrade.guildma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GUILDMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Guildma tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/guildma"
        date = "2026-10-16"
    strings:
        $attrib_str = "guildma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Gupd (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/gupd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_GUPD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gupd (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gupd"
        date = "2026-10-16"
    strings:
        $fam_name = "gupd" ascii wide nocase
        $alias_1 = "trojan.gupd" ascii wide nocase
        $alias_2 = "fakeupdate.gupd" ascii wide nocase
        $alias_3 = "win32/gupd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_GUPD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gupd tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/gupd"
        date = "2026-10-16"
    strings:
        $attrib_str = "gupd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Habbo (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/habbo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HABBO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Habbo (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/habbo"
        date = "2026-10-16"
    strings:
        $fam_name = "habbo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HABBO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Habbo tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/habbo"
        date = "2026-10-16"
    strings:
        $attrib_str = "habbo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hacdef (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hacdef
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HACDEF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hacdef (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hacdef"
        date = "2026-10-16"
    strings:
        $fam_name = "hacdef" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HACDEF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hacdef tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hacdef"
        date = "2026-10-16"
    strings:
        $attrib_str = "hacdef" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Hack_A_Tack (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hack_a_tack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HACK_A_TACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hack_A_Tack (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hack_a_tack"
        date = "2026-10-16"
    strings:
        $fam_name = "hack_a_tack" ascii wide nocase
        $alias_1 = "trojan:win32/hackatack" ascii wide nocase
        $alias_2 = "backdoor.hackatack" ascii wide nocase
        $alias_3 = "trojan.hack-a-tack" ascii wide nocase
        $alias_4 = "win32/hackatack.rat" ascii wide nocase
        $alias_5 = "backdoor.win32.hackatack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HACK_A_TACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hack_A_Tack tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hack_a_tack"
        date = "2026-10-16"
    strings:
        $attrib_str = "hack_a_tack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hackav (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hackav
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HACKAV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hackav (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hackav"
        date = "2026-10-16"
    strings:
        $fam_name = "hackav" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HACKAV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hackav tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hackav"
        date = "2026-10-16"
    strings:
        $attrib_str = "hackav" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Haed (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/haed
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Haed (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/haed"
        date = "2026-10-16"
    strings:
        $fam_name = "haed" ascii wide nocase
        $alias_1 = "trojan.haed" ascii wide nocase
        $alias_2 = "downloader.haed" ascii wide nocase
        $alias_3 = "win32/haed" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Haed tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/haed"
        date = "2026-10-16"
    strings:
        $attrib_str = "haed" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hafen (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hafen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAFEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hafen (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hafen"
        date = "2026-10-16"
    strings:
        $fam_name = "hafen" ascii wide nocase
        $alias_1 = "backdoor:win32/hafen" ascii wide nocase
        $alias_2 = "bkdr_hafen.a" ascii wide nocase
        $alias_3 = "trojan:win32/hafen" ascii wide nocase
        $alias_4 = "win32/hafen" ascii wide nocase
        $alias_5 = "trojan.hafen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAFEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hafen tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hafen"
        date = "2026-10-16"
    strings:
        $attrib_str = "hafen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Haknata (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/haknata
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAKNATA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Haknata (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/haknata"
        date = "2026-10-16"
    strings:
        $fam_name = "haknata" ascii wide nocase
        $alias_1 = "trojan.haknata" ascii wide nocase
        $alias_2 = "downloader.haknata" ascii wide nocase
        $alias_3 = "win32/haknata" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAKNATA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Haknata tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/haknata"
        date = "2026-10-16"
    strings:
        $attrib_str = "haknata" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hakopsbot (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hakopsbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAKOPSBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hakopsbot (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hakopsbot"
        date = "2026-10-16"
    strings:
        $fam_name = "hakopsbot" ascii wide nocase
        $alias_1 = "keylogger.hakopsbot" ascii wide nocase
        $alias_2 = "spyware.hakops" ascii wide nocase
        $alias_3 = "trojan.pws.hakops" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAKOPSBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hakopsbot tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hakopsbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "hakopsbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hallaj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hallaj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HALLAJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hallaj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hallaj"
        date = "2026-10-16"
    strings:
        $fam_name = "hallaj" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HALLAJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hallaj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hallaj"
        date = "2026-10-16"
    strings:
        $attrib_str = "hallaj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hamaetot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hamaetot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAMAETOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hamaetot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hamaetot"
        date = "2026-10-16"
    strings:
        $fam_name = "hamaetot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAMAETOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hamaetot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hamaetot"
        date = "2026-10-16"
    strings:
        $attrib_str = "hamaetot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hamer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hamer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAMER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hamer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hamer"
        date = "2026-10-16"
    strings:
        $fam_name = "hamer" ascii wide nocase
        $alias_1 = "trojan.hamer" ascii wide nocase
        $alias_2 = "downloader.hamer" ascii wide nocase
        $alias_3 = "win32/hamer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAMER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hamer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hamer"
        date = "2026-10-16"
    strings:
        $attrib_str = "hamer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hamweq (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hamweq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAMWEQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hamweq (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hamweq"
        date = "2026-10-16"
    strings:
        $fam_name = "hamweq" ascii wide nocase
        $alias_1 = "worm.hamweq" ascii wide nocase
        $alias_2 = "irc.hamweq" ascii wide nocase
        $alias_3 = "win32/hamweq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAMWEQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hamweq tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hamweq"
        date = "2026-10-16"
    strings:
        $attrib_str = "hamweq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hancitor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hancitor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HANCITOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hancitor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hancitor"
        date = "2026-10-16"
    strings:
        $fam_name = "hancitor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HANCITOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hancitor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hancitor"
        date = "2026-10-16"
    strings:
        $attrib_str = "hancitor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hangup (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hangup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HANGUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hangup (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hangup"
        date = "2026-10-16"
    strings:
        $fam_name = "hangup" ascii wide nocase
        $alias_1 = "trojan.hangup" ascii wide nocase
        $alias_2 = "downloader.hangup" ascii wide nocase
        $alias_3 = "win32/hangup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HANGUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hangup tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hangup"
        date = "2026-10-16"
    strings:
        $attrib_str = "hangup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Haperlock (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/haperlock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAPERLOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Haperlock (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/haperlock"
        date = "2026-10-16"
    strings:
        $fam_name = "haperlock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAPERLOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Haperlock tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/haperlock"
        date = "2026-10-16"
    strings:
        $attrib_str = "haperlock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Happy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/happy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAPPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Happy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/happy"
        date = "2026-10-16"
    strings:
        $fam_name = "happy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAPPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Happy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/happy"
        date = "2026-10-16"
    strings:
        $attrib_str = "happy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Harnig (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/harnig
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HARNIG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Harnig (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/harnig"
        date = "2026-10-16"
    strings:
        $fam_name = "harnig" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HARNIG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Harnig tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/harnig"
        date = "2026-10-16"
    strings:
        $attrib_str = "harnig" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Harvester (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/harvester
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HARVESTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Harvester (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/harvester"
        date = "2026-10-16"
    strings:
        $fam_name = "harvester" ascii wide nocase
        $alias_1 = "trojan.harvester" ascii wide nocase
        $alias_2 = "spyware.harvester" ascii wide nocase
        $alias_3 = "pws.win32.harvester" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HARVESTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Harvester tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/harvester"
        date = "2026-10-16"
    strings:
        $attrib_str = "harvester" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hav_Rat (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hav_rat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAV_RAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hav_Rat (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hav_rat"
        date = "2026-10-16"
    strings:
        $fam_name = "hav_rat" ascii wide nocase
        $alias_1 = "backdoor:win32/havrat" ascii wide nocase
        $alias_2 = "trojan.win32.havrat" ascii wide nocase
        $alias_3 = "backdoor.havrat" ascii wide nocase
        $alias_4 = "win32/havrat.rat" ascii wide nocase
        $alias_5 = "trojan.havrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAV_RAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hav_Rat tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hav_rat"
        date = "2026-10-16"
    strings:
        $attrib_str = "hav_rat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Havex (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/havex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAVEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Havex (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/havex"
        date = "2026-10-16"
    strings:
        $fam_name = "havex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAVEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Havex tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/havex"
        date = "2026-10-16"
    strings:
        $attrib_str = "havex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hawkeyekeylogger (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hawkeyekeylogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HAWKEYEKEYLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hawkeyekeylogger (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hawkeyekeylogger"
        date = "2026-10-16"
    strings:
        $fam_name = "hawkeyekeylogger" ascii wide nocase
        $alias_1 = "hawkeye keylogger" ascii wide nocase
        $alias_2 = "hawkeye reborn" ascii wide nocase
        $alias_3 = "trojan.hawkeye" ascii wide nocase
        $alias_4 = "spyware.hawkeye" ascii wide nocase
        $alias_5 = "win32/hawkeye" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HAWKEYEKEYLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hawkeyekeylogger tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hawkeyekeylogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "hawkeyekeylogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hbov (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hbov
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HBOV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hbov (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hbov"
        date = "2026-10-16"
    strings:
        $fam_name = "hbov" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HBOV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hbov tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hbov"
        date = "2026-10-16"
    strings:
        $attrib_str = "hbov" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hc4Cakjs5Bhi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hc4cakjs5bhi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HC4CAKJS5BHI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hc4Cakjs5Bhi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hc4cakjs5bhi"
        date = "2026-10-16"
    strings:
        $fam_name = "hc4cakjs5bhi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HC4CAKJS5BHI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hc4Cakjs5Bhi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hc4cakjs5bhi"
        date = "2026-10-16"
    strings:
        $attrib_str = "hc4cakjs5bhi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hckpk (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hckpk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HCKPK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hckpk (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hckpk"
        date = "2026-10-16"
    strings:
        $fam_name = "hckpk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HCKPK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hckpk tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hckpk"
        date = "2026-10-16"
    strings:
        $attrib_str = "hckpk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Headache (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/headache
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HEADACHE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Headache (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/headache"
        date = "2026-10-16"
    strings:
        $fam_name = "headache" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HEADACHE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Headache tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/headache"
        date = "2026-10-16"
    strings:
        $attrib_str = "headache" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hebogo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hebogo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HEBOGO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hebogo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hebogo"
        date = "2026-10-16"
    strings:
        $fam_name = "hebogo" ascii wide nocase
        $alias_1 = "ransom:win32/hebogo" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.hebogo" ascii wide nocase
        $alias_3 = "trojan.hebogo" ascii wide nocase
        $alias_4 = "win32/hebogo" ascii wide nocase
        $alias_5 = "ransom:win32/hebogo.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HEBOGO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hebogo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hebogo"
        date = "2026-10-16"
    strings:
        $attrib_str = "hebogo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Helper (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/helper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HELPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Helper (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/helper"
        date = "2026-10-16"
    strings:
        $fam_name = "helper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HELPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Helper tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/helper"
        date = "2026-10-16"
    strings:
        $attrib_str = "helper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hematite (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hematite
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HEMATITE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hematite (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hematite"
        date = "2026-10-16"
    strings:
        $fam_name = "hematite" ascii wide nocase
        $alias_1 = "win.virus.hematite" ascii wide nocase
        $alias_2 = "trojan.hematite" ascii wide nocase
        $alias_3 = "trojan:win32/hematite!rfn" ascii wide nocase
        $alias_4 = "virus:win32/hematite.a" ascii wide nocase
        $alias_5 = "win32/hematite" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HEMATITE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hematite tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hematite"
        date = "2026-10-16"
    strings:
        $attrib_str = "hematite" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Heriplor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/heriplor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HERIPLOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Heriplor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/heriplor"
        date = "2026-10-16"
    strings:
        $fam_name = "heriplor" ascii wide nocase
        $alias_1 = "trojan.heriplor" ascii wide nocase
        $alias_2 = "downloader.heriplor" ascii wide nocase
        $alias_3 = "win32/heriplor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HERIPLOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Heriplor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/heriplor"
        date = "2026-10-16"
    strings:
        $attrib_str = "heriplor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hermes (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hermes
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HERMES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hermes (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hermes"
        date = "2026-10-16"
    strings:
        $fam_name = "hermes" ascii wide nocase
        $alias_1 = "hermes" ascii wide nocase
        $alias_2 = "hermes 2.1" ascii wide nocase
        $alias_3 = "ransom.hermes" ascii wide nocase
        $alias_4 = "trojan-ransom.win32.hermes" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HERMES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hermes tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hermes"
        date = "2026-10-16"
    strings:
        $attrib_str = "hermes" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hesv (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hesv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HESV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hesv (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hesv"
        date = "2026-10-16"
    strings:
        $fam_name = "hesv" ascii wide nocase
        $alias_1 = "trojan:win32/hesv" ascii wide nocase
        $alias_2 = "trojan.win32.hesv" ascii wide nocase
        $alias_3 = "trojan.msil.hesv" ascii wide nocase
        $alias_4 = "win32/hesv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HESV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hesv tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hesv"
        date = "2026-10-16"
    strings:
        $attrib_str = "hesv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hexloader (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hexloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HEXLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hexloader (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hexloader"
        date = "2026-10-16"
    strings:
        $fam_name = "hexloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HEXLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hexloader tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hexloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "hexloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hexzone (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hexzone
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HEXZONE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hexzone (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hexzone"
        date = "2026-10-16"
    strings:
        $fam_name = "hexzone" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HEXZONE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hexzone tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hexzone"
        date = "2026-10-16"
    strings:
        $attrib_str = "hexzone" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Heye (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/heye
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HEYE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Heye (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/heye"
        date = "2026-10-16"
    strings:
        $fam_name = "heye" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HEYE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Heye tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/heye"
        date = "2026-10-16"
    strings:
        $attrib_str = "heye" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hezhi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hezhi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HEZHI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hezhi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hezhi"
        date = "2026-10-16"
    strings:
        $fam_name = "hezhi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HEZHI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hezhi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hezhi"
        date = "2026-10-16"
    strings:
        $attrib_str = "hezhi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hg8Absxocmcj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hg8absxocmcj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HG8ABSXOCMCJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hg8Absxocmcj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hg8absxocmcj"
        date = "2026-10-16"
    strings:
        $fam_name = "hg8absxocmcj" ascii wide nocase
        $alias_1 = "trojan.generic.hg8absxocmcj" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HG8ABSXOCMCJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hg8Absxocmcj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hg8absxocmcj"
        date = "2026-10-16"
    strings:
        $attrib_str = "hg8absxocmcj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hidcon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hidcon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIDCON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hidcon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hidcon"
        date = "2026-10-16"
    strings:
        $fam_name = "hidcon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIDCON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hidcon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hidcon"
        date = "2026-10-16"
    strings:
        $attrib_str = "hidcon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hiddeninstall (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hiddeninstall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIDDENINSTALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hiddeninstall (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hiddeninstall"
        date = "2026-10-16"
    strings:
        $fam_name = "hiddeninstall" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIDDENINSTALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hiddeninstall tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hiddeninstall"
        date = "2026-10-16"
    strings:
        $attrib_str = "hiddeninstall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hiddentear (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hiddentear
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIDDENTEAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hiddentear (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hiddentear"
        date = "2026-10-16"
    strings:
        $fam_name = "hiddentear" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIDDENTEAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hiddentear tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hiddentear"
        date = "2026-10-16"
    strings:
        $attrib_str = "hiddentear" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hiddentears (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hiddentears
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIDDENTEARS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hiddentears (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hiddentears"
        date = "2026-10-16"
    strings:
        $fam_name = "hiddentears" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIDDENTEARS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hiddentears tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hiddentears"
        date = "2026-10-16"
    strings:
        $attrib_str = "hiddentears" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hideproc (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hideproc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIDEPROC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hideproc (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hideproc"
        date = "2026-10-16"
    strings:
        $fam_name = "hideproc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIDEPROC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hideproc tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hideproc"
        date = "2026-10-16"
    strings:
        $attrib_str = "hideproc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for High (Generic_Detection)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/high
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIGH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for High (Generic_Detection)"
        category = "Generic_Detection"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/high"
        date = "2026-10-16"
    strings:
        $fam_name = "high" ascii wide nocase
        $alias_1 = "highrisk" ascii wide nocase
        $alias_2 = "risk.high" ascii wide nocase
        $alias_3 = "generic.high" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIGH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for High tradecraft"
        category = "Generic_Detection"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/high"
        date = "2026-10-16"
    strings:
        $attrib_str = "high" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Higuniel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/higuniel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIGUNIEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Higuniel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/higuniel"
        date = "2026-10-16"
    strings:
        $fam_name = "higuniel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIGUNIEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Higuniel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/higuniel"
        date = "2026-10-16"
    strings:
        $attrib_str = "higuniel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hijacker (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hijacker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIJACKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hijacker (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hijacker"
        date = "2026-10-16"
    strings:
        $fam_name = "hijacker" ascii wide nocase
        $alias_1 = "browsermodifier:win32/hijacker" ascii wide nocase
        $alias_2 = "adware:win32/hijacker" ascii wide nocase
        $alias_3 = "trojan:win32/hijacker" ascii wide nocase
        $alias_4 = "win32/hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIJACKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hijacker tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hijacker"
        date = "2026-10-16"
    strings:
        $attrib_str = "hijacker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hilevel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hilevel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HILEVEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hilevel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hilevel"
        date = "2026-10-16"
    strings:
        $fam_name = "hilevel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HILEVEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hilevel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hilevel"
        date = "2026-10-16"
    strings:
        $attrib_str = "hilevel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hiloti (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hiloti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HILOTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hiloti (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hiloti"
        date = "2026-10-16"
    strings:
        $fam_name = "hiloti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HILOTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hiloti tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hiloti"
        date = "2026-10-16"
    strings:
        $attrib_str = "hiloti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Himera (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/himera
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIMERA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Himera (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/himera"
        date = "2026-10-16"
    strings:
        $fam_name = "himera" ascii wide nocase
        $alias_1 = "trojan.himera" ascii wide nocase
        $alias_2 = "pws.himera" ascii wide nocase
        $alias_3 = "trojanspy.himerastealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIMERA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Himera tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/himera"
        date = "2026-10-16"
    strings:
        $attrib_str = "himera" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Hioles (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hioles
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIOLES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hioles (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hioles"
        date = "2026-10-16"
    strings:
        $fam_name = "hioles" ascii wide nocase
        $alias_1 = "trojan.hioles" ascii wide nocase
        $alias_2 = "backdoor.hioles" ascii wide nocase
        $alias_3 = "win32/hioles" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIOLES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hioles tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hioles"
        date = "2026-10-16"
    strings:
        $attrib_str = "hioles" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hiru (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hiru
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HIRU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hiru (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hiru"
        date = "2026-10-16"
    strings:
        $fam_name = "hiru" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HIRU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hiru tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hiru"
        date = "2026-10-16"
    strings:
        $attrib_str = "hiru" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hkautoit (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hkautoit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HKAUTOIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hkautoit (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hkautoit"
        date = "2026-10-16"
    strings:
        $fam_name = "hkautoit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HKAUTOIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hkautoit tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hkautoit"
        date = "2026-10-16"
    strings:
        $attrib_str = "hkautoit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hkmain (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hkmain
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HKMAIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hkmain (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hkmain"
        date = "2026-10-16"
    strings:
        $fam_name = "hkmain" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HKMAIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hkmain tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hkmain"
        date = "2026-10-16"
    strings:
        $attrib_str = "hkmain" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hlubea (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hlubea
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HLUBEA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hlubea (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hlubea"
        date = "2026-10-16"
    strings:
        $fam_name = "hlubea" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HLUBEA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hlubea tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hlubea"
        date = "2026-10-16"
    strings:
        $attrib_str = "hlubea" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hlux (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hlux
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HLUX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hlux (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hlux"
        date = "2026-10-16"
    strings:
        $fam_name = "hlux" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HLUX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hlux tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hlux"
        date = "2026-10-16"
    strings:
        $attrib_str = "hlux" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hmgfa45Id4O (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hmgfa45id4o
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HMGFA45ID4O_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hmgfa45Id4O (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hmgfa45id4o"
        date = "2026-10-16"
    strings:
        $fam_name = "hmgfa45id4o" ascii wide nocase
        $alias_1 = "generic.hmgfa45id4o" ascii wide nocase
        $alias_2 = "suspicious.hmgfa45id4o" ascii wide nocase
        $alias_3 = "heur.hmgfa45id4o" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HMGFA45ID4O_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hmgfa45Id4O tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hmgfa45id4o"
        date = "2026-10-16"
    strings:
        $attrib_str = "hmgfa45id4o" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hoax (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hoax
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOAX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hoax (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hoax"
        date = "2026-10-16"
    strings:
        $fam_name = "hoax" ascii wide nocase
        $alias_1 = "trojan-ransom.win32.hoax" ascii wide nocase
        $alias_2 = "ransom:win32/hoax" ascii wide nocase
        $alias_3 = "scareware.hoax" ascii wide nocase
        $alias_4 = "win32/hoax" ascii wide nocase
        $alias_5 = "fakeav.hoax" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOAX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hoax tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hoax"
        date = "2026-10-16"
    strings:
        $attrib_str = "hoax" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hokobot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hokobot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOKOBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hokobot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hokobot"
        date = "2026-10-16"
    strings:
        $fam_name = "hokobot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOKOBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hokobot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hokobot"
        date = "2026-10-16"
    strings:
        $attrib_str = "hokobot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Homles (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/homles
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOMLES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Homles (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/homles"
        date = "2026-10-16"
    strings:
        $fam_name = "homles" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOMLES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Homles tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/homles"
        date = "2026-10-16"
    strings:
        $attrib_str = "homles" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Honk (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/honk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HONK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Honk (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/honk"
        date = "2026-10-16"
    strings:
        $fam_name = "honk" ascii wide nocase
        $alias_1 = "trojan.honk" ascii wide nocase
        $alias_2 = "downloader.honk" ascii wide nocase
        $alias_3 = "win32/honk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HONK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Honk tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/honk"
        date = "2026-10-16"
    strings:
        $attrib_str = "honk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hooker (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hooker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOOKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hooker (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hooker"
        date = "2026-10-16"
    strings:
        $fam_name = "hooker" ascii wide nocase
        $alias_1 = "spyware.hooker" ascii wide nocase
        $alias_2 = "trojan.keylogger.hook" ascii wide nocase
        $alias_3 = "hacktool.hooker" ascii wide nocase
        $alias_4 = "win32/apihook" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOOKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hooker tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hooker"
        date = "2026-10-16"
    strings:
        $attrib_str = "hooker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hookey (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hookey
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOOKEY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hookey (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hookey"
        date = "2026-10-16"
    strings:
        $fam_name = "hookey" ascii wide nocase
        $alias_1 = "spyware:win32/hookey" ascii wide nocase
        $alias_2 = "trojan:win32/hookey" ascii wide nocase
        $alias_3 = "win32/hookey" ascii wide nocase
        $alias_4 = "hookey keylogger" ascii wide nocase
        $alias_5 = "spyware.hookey" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOOKEY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hookey tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hookey"
        date = "2026-10-16"
    strings:
        $attrib_str = "hookey" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hookmoot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hookmoot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOOKMOOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hookmoot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hookmoot"
        date = "2026-10-16"
    strings:
        $fam_name = "hookmoot" ascii wide nocase
        $alias_1 = "trojan.hookmoot" ascii wide nocase
        $alias_2 = "downloader.hookmoot" ascii wide nocase
        $alias_3 = "win32/hookmoot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOOKMOOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hookmoot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hookmoot"
        date = "2026-10-16"
    strings:
        $attrib_str = "hookmoot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Horst (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/horst
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HORST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Horst (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/horst"
        date = "2026-10-16"
    strings:
        $fam_name = "horst" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HORST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Horst tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/horst"
        date = "2026-10-16"
    strings:
        $attrib_str = "horst" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hostmodifier (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hostmodifier
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOSTMODIFIER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hostmodifier (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hostmodifier"
        date = "2026-10-16"
    strings:
        $fam_name = "hostmodifier" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOSTMODIFIER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hostmodifier tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hostmodifier"
        date = "2026-10-16"
    strings:
        $attrib_str = "hostmodifier" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hosts (Trojan_Generic)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hosts
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOSTS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hosts (Trojan_Generic)"
        category = "Trojan_Generic"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hosts"
        date = "2026-10-16"
    strings:
        $fam_name = "hosts" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOSTS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hosts tradecraft"
        category = "Trojan_Generic"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hosts"
        date = "2026-10-16"
    strings:
        $attrib_str = "hosts" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hostschanger (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hostschanger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOSTSCHANGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hostschanger (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hostschanger"
        date = "2026-10-16"
    strings:
        $fam_name = "hostschanger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOSTSCHANGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hostschanger tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hostschanger"
        date = "2026-10-16"
    strings:
        $attrib_str = "hostschanger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hostseditor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hostseditor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOSTSEDITOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hostseditor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hostseditor"
        date = "2026-10-16"
    strings:
        $fam_name = "hostseditor" ascii wide nocase
        $alias_1 = "trojan.hosts" ascii wide nocase
        $alias_2 = "riskware.hostseditor" ascii wide nocase
        $alias_3 = "hacktool:win32/hostsmod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOSTSEDITOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hostseditor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hostseditor"
        date = "2026-10-16"
    strings:
        $attrib_str = "hostseditor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hostspatcher (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hostspatcher
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOSTSPATCHER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hostspatcher (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hostspatcher"
        date = "2026-10-16"
    strings:
        $fam_name = "hostspatcher" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOSTSPATCHER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hostspatcher tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hostspatcher"
        date = "2026-10-16"
    strings:
        $attrib_str = "hostspatcher" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hostwack (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hostwack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOSTWACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hostwack (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hostwack"
        date = "2026-10-16"
    strings:
        $fam_name = "hostwack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOSTWACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hostwack tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hostwack"
        date = "2026-10-16"
    strings:
        $attrib_str = "hostwack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hotbar (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hotbar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOTBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hotbar (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hotbar"
        date = "2026-10-16"
    strings:
        $fam_name = "hotbar" ascii wide nocase
        $alias_1 = "adware:win32/hotbar" ascii wide nocase
        $alias_2 = "pua:win32/hotbar" ascii wide nocase
        $alias_3 = "toolbar.hotbar" ascii wide nocase
        $alias_4 = "win32/hotbar" ascii wide nocase
        $alias_5 = "hotbar adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOTBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hotbar tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hotbar"
        date = "2026-10-16"
    strings:
        $attrib_str = "hotbar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hotdownloads (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hotdownloads
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOTDOWNLOADS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hotdownloads (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hotdownloads"
        date = "2026-10-16"
    strings:
        $fam_name = "hotdownloads" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOTDOWNLOADS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hotdownloads tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hotdownloads"
        date = "2026-10-16"
    strings:
        $attrib_str = "hotdownloads" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hotkeyshook (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hotkeyshook
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOTKEYSHOOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hotkeyshook (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hotkeyshook"
        date = "2026-10-16"
    strings:
        $fam_name = "hotkeyshook" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOTKEYSHOOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hotkeyshook tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hotkeyshook"
        date = "2026-10-16"
    strings:
        $attrib_str = "hotkeyshook" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Houndhack (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/houndhack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HOUNDHACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Houndhack (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/houndhack"
        date = "2026-10-16"
    strings:
        $fam_name = "houndhack" ascii wide nocase
        $alias_1 = "hacktool:win32/houndhack" ascii wide nocase
        $alias_2 = "backdoor:win32/houndhack" ascii wide nocase
        $alias_3 = "trojan.houndhack" ascii wide nocase
        $alias_4 = "win32/houndhack" ascii wide nocase
        $alias_5 = "hacktool.houndhack" ascii wide nocase
        $alias_6 = "houndhack rat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HOUNDHACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Houndhack tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/houndhack"
        date = "2026-10-16"
    strings:
        $attrib_str = "houndhack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Hpcubestlr (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hpcubestlr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HPCUBESTLR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hpcubestlr (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hpcubestlr"
        date = "2026-10-16"
    strings:
        $fam_name = "hpcubestlr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HPCUBESTLR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hpcubestlr tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hpcubestlr"
        date = "2026-10-16"
    strings:
        $attrib_str = "hpcubestlr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hpdefender (Rogue_Antivirus)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hpdefender
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HPDEFENDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hpdefender (Rogue_Antivirus)"
        category = "Rogue_Antivirus"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hpdefender"
        date = "2026-10-16"
    strings:
        $fam_name = "hpdefender" ascii wide nocase
        $alias_1 = "rogue:win32/hpdefender" ascii wide nocase
        $alias_2 = "trojan:win32/hpdefender" ascii wide nocase
        $alias_3 = "rogue.hpdefender" ascii wide nocase
        $alias_4 = "win32/hpdefender" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HPDEFENDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hpdefender tradecraft"
        category = "Rogue_Antivirus"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hpdefender"
        date = "2026-10-16"
    strings:
        $attrib_str = "hpdefender" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hpfareit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hpfareit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HPFAREIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hpfareit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hpfareit"
        date = "2026-10-16"
    strings:
        $fam_name = "hpfareit" ascii wide nocase
        $alias_1 = "trojan.fareit" ascii wide nocase
        $alias_2 = "pony stealer" ascii wide nocase
        $alias_3 = "passwordstealer.fareit" ascii wide nocase
        $alias_4 = "win32/fareit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HPFAREIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hpfareit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hpfareit"
        date = "2026-10-16"
    strings:
        $attrib_str = "hpfareit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hpgen (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hpgen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HPGEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hpgen (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hpgen"
        date = "2026-10-16"
    strings:
        $fam_name = "hpgen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HPGEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hpgen tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hpgen"
        date = "2026-10-16"
    strings:
        $attrib_str = "hpgen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hploki (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hploki
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HPLOKI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hploki (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hploki"
        date = "2026-10-16"
    strings:
        $fam_name = "hploki" ascii wide nocase
        $alias_1 = "trojan:win32/hploki" ascii wide nocase
        $alias_2 = "trojan:win32/hploki!rfn" ascii wide nocase
        $alias_3 = "trojan-psw.win32.loki" ascii wide nocase
        $alias_4 = "pws:win32/lokibot" ascii wide nocase
        $alias_5 = "win32/hploki" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HPLOKI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hploki tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hploki"
        date = "2026-10-16"
    strings:
        $attrib_str = "hploki" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hptrickbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hptrickbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HPTRICKBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hptrickbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hptrickbot"
        date = "2026-10-16"
    strings:
        $fam_name = "hptrickbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HPTRICKBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hptrickbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hptrickbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "hptrickbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hpursnif (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hpursnif
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HPURSNIF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hpursnif (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hpursnif"
        date = "2026-10-16"
    strings:
        $fam_name = "hpursnif" ascii wide nocase
        $alias_1 = "trojan.ursnif" ascii wide nocase
        $alias_2 = "banker.gozi" ascii wide nocase
        $alias_3 = "win32/isfb" ascii wide nocase
        $alias_4 = "trojan-banker.win32.ursnif" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HPURSNIF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hpursnif tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hpursnif"
        date = "2026-10-16"
    strings:
        $attrib_str = "hpursnif" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hqsi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hqsi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HQSI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hqsi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hqsi"
        date = "2026-10-16"
    strings:
        $fam_name = "hqsi" ascii wide nocase
        $alias_1 = "trojan.hqsi" ascii wide nocase
        $alias_2 = "downloader.hqsi" ascii wide nocase
        $alias_3 = "win32/hqsi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HQSI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hqsi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hqsi"
        date = "2026-10-16"
    strings:
        $attrib_str = "hqsi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hrup (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hrup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HRUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hrup (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hrup"
        date = "2026-10-16"
    strings:
        $fam_name = "hrup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HRUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hrup tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hrup"
        date = "2026-10-16"
    strings:
        $attrib_str = "hrup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Httpbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/httpbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HTTPBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Httpbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/httpbot"
        date = "2026-10-16"
    strings:
        $fam_name = "httpbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HTTPBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Httpbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/httpbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "httpbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hue (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hue
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HUE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hue (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hue"
        date = "2026-10-16"
    strings:
        $fam_name = "hue" ascii wide nocase
        $alias_1 = "trojan:win32/hue" ascii wide nocase
        $alias_2 = "backdoor:win32/hue" ascii wide nocase
        $alias_3 = "trojan.win32.hue" ascii wide nocase
        $alias_4 = "win32/hue.backdoor" ascii wide nocase
        $alias_5 = "backdoor.hue.gen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HUE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hue tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hue"
        date = "2026-10-16"
    strings:
        $attrib_str = "hue" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Huhk (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/huhk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HUHK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Huhk (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/huhk"
        date = "2026-10-16"
    strings:
        $fam_name = "huhk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HUHK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Huhk tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/huhk"
        date = "2026-10-16"
    strings:
        $attrib_str = "huhk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Huntpos (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/huntpos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HUNTPOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Huntpos (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/huntpos"
        date = "2026-10-16"
    strings:
        $fam_name = "huntpos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HUNTPOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Huntpos tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/huntpos"
        date = "2026-10-16"
    strings:
        $attrib_str = "huntpos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hupigon (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hupigon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HUPIGON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hupigon (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hupigon"
        date = "2026-10-16"
    strings:
        $fam_name = "hupigon" ascii wide nocase
        $alias_1 = "hupigon" ascii wide nocase
        $alias_2 = "huigezi" ascii wide nocase
        $alias_3 = "grey pigeon" ascii wide nocase
        $alias_4 = "backdoor.hupigon" ascii wide nocase
        $alias_5 = "win32/hupigon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HUPIGON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hupigon tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hupigon"
        date = "2026-10-16"
    strings:
        $attrib_str = "hupigon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Hvnc (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hvnc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HVNC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hvnc (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hvnc"
        date = "2026-10-16"
    strings:
        $fam_name = "hvnc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HVNC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hvnc tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hvnc"
        date = "2026-10-16"
    strings:
        $attrib_str = "hvnc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Hvom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hvom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HVOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hvom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hvom"
        date = "2026-10-16"
    strings:
        $fam_name = "hvom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HVOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hvom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hvom"
        date = "2026-10-16"
    strings:
        $attrib_str = "hvom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hworld (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hworld
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HWORLD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hworld (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hworld"
        date = "2026-10-16"
    strings:
        $fam_name = "hworld" ascii wide nocase
        $alias_1 = "worm:win32/hworld.a" ascii wide nocase
        $alias_2 = "w32/hworld.a" ascii wide nocase
        $alias_3 = "worm_hworld.a" ascii wide nocase
        $alias_4 = "backdoor:win32/hworld" ascii wide nocase
        $alias_5 = "w32.hworld.worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HWORLD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hworld tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hworld"
        date = "2026-10-16"
    strings:
        $attrib_str = "hworld" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hydracrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hydracrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HYDRACRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hydracrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hydracrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "hydracrypt" ascii wide nocase
        $alias_1 = "hydracrypt" ascii wide nocase
        $alias_2 = "ransomware:win32/hydracrypt" ascii wide nocase
        $alias_3 = "crypboss.hydracrypt" ascii wide nocase
        $alias_4 = "umbrecrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HYDRACRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hydracrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hydracrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "hydracrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hydrapos (Pos_Malware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hydrapos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HYDRAPOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hydrapos (Pos_Malware)"
        category = "Pos_Malware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hydrapos"
        date = "2026-10-16"
    strings:
        $fam_name = "hydrapos" ascii wide nocase
        $alias_1 = "trojan:win32/hydrapos" ascii wide nocase
        $alias_2 = "trojan-pos.win32.hydra" ascii wide nocase
        $alias_3 = "pws:win32/hydrapos" ascii wide nocase
        $alias_4 = "hydrapos memory scraper" ascii wide nocase
        $alias_5 = "win32/hydrapos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HYDRAPOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hydrapos tradecraft"
        category = "Pos_Malware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hydrapos"
        date = "2026-10-16"
    strings:
        $attrib_str = "hydrapos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Hype (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hype
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HYPE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hype (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hype"
        date = "2026-10-16"
    strings:
        $fam_name = "hype" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HYPE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hype tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hype"
        date = "2026-10-16"
    strings:
        $attrib_str = "hype" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Hyperbro (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/hyperbro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_HYPERBRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Hyperbro (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hyperbro"
        date = "2026-10-16"
    strings:
        $fam_name = "hyperbro" ascii wide nocase
        $alias_1 = "apt.hyperbro" ascii wide nocase
        $alias_2 = "backdoor.hyperbro" ascii wide nocase
        $alias_3 = "win32/hyperbro" ascii wide nocase
        $alias_4 = "apt27.payload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_HYPERBRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Hyperbro tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/hyperbro"
        date = "2026-10-16"
    strings:
        $attrib_str = "hyperbro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ibryte (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ibryte
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IBRYTE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ibryte (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ibryte"
        date = "2026-10-16"
    strings:
        $fam_name = "ibryte" ascii wide nocase
        $alias_1 = "softwarebundler:win32/ibryte" ascii wide nocase
        $alias_2 = "pua:win32/ibryte" ascii wide nocase
        $alias_3 = "adware:win32/ibryte" ascii wide nocase
        $alias_4 = "win32/ibryte" ascii wide nocase
        $alias_5 = "ibryte downloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IBRYTE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ibryte tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ibryte"
        date = "2026-10-16"
    strings:
        $attrib_str = "ibryte" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Icecold_Reloaded (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/icecold_reloaded
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ICECOLD_RELOADED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Icecold_Reloaded (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/icecold_reloaded"
        date = "2026-10-16"
    strings:
        $fam_name = "icecold_reloaded" ascii wide nocase
        $alias_1 = "backdoor:win32/icecold.reloaded" ascii wide nocase
        $alias_2 = "trojan.win32.icecold" ascii wide nocase
        $alias_3 = "backdoor.icecold" ascii wide nocase
        $alias_4 = "win32/icecold.rat" ascii wide nocase
        $alias_5 = "trojan.icecoldreloaded" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ICECOLD_RELOADED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Icecold_Reloaded tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/icecold_reloaded"
        date = "2026-10-16"
    strings:
        $attrib_str = "icecold_reloaded" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Icedid (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/icedid
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ICEDID_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Icedid (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/icedid"
        date = "2026-10-16"
    strings:
        $fam_name = "icedid" ascii wide nocase
        $alias_1 = "icedid" ascii wide nocase
        $alias_2 = "bokbot" ascii wide nocase
        $alias_3 = "trojan.icedid" ascii wide nocase
        $alias_4 = "banking.bokbot" ascii wide nocase
        $alias_5 = "win32/icedid" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ICEDID_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Icedid tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/icedid"
        date = "2026-10-16"
    strings:
        $attrib_str = "icedid" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Icloader (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/icloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ICLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Icloader (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/icloader"
        date = "2026-10-16"
    strings:
        $fam_name = "icloader" ascii wide nocase
        $alias_1 = "pua:win32/icloader" ascii wide nocase
        $alias_2 = "trojan:win32/icloader" ascii wide nocase
        $alias_3 = "win32/icloader" ascii wide nocase
        $alias_4 = "pup.optional.icloader" ascii wide nocase
        $alias_5 = "installcore.icloader" ascii wide nocase
        $alias_6 = "adware:win32/installcore" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ICLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Icloader tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/icloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "icloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Iczu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/iczu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ICZU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Iczu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/iczu"
        date = "2026-10-16"
    strings:
        $fam_name = "iczu" ascii wide nocase
        $alias_1 = "trojan.iczu" ascii wide nocase
        $alias_2 = "downloader.iczu" ascii wide nocase
        $alias_3 = "win32/iczu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ICZU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Iczu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/iczu"
        date = "2026-10-16"
    strings:
        $attrib_str = "iczu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ident (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ident
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IDENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ident (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ident"
        date = "2026-10-16"
    strings:
        $fam_name = "ident" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IDENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ident tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ident"
        date = "2026-10-16"
    strings:
        $attrib_str = "ident" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Idlebuddy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/idlebuddy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IDLEBUDDY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Idlebuddy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/idlebuddy"
        date = "2026-10-16"
    strings:
        $fam_name = "idlebuddy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IDLEBUDDY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Idlebuddy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/idlebuddy"
        date = "2026-10-16"
    strings:
        $attrib_str = "idlebuddy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Idlecrawler (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/idlecrawler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IDLECRAWLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Idlecrawler (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/idlecrawler"
        date = "2026-10-16"
    strings:
        $fam_name = "idlecrawler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IDLECRAWLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Idlecrawler tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/idlecrawler"
        date = "2026-10-16"
    strings:
        $attrib_str = "idlecrawler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Idlekms (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/idlekms
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IDLEKMS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Idlekms (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/idlekms"
        date = "2026-10-16"
    strings:
        $fam_name = "idlekms" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IDLEKMS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Idlekms tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/idlekms"
        date = "2026-10-16"
    strings:
        $attrib_str = "idlekms" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Idsohtu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/idsohtu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IDSOHTU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Idsohtu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/idsohtu"
        date = "2026-10-16"
    strings:
        $fam_name = "idsohtu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IDSOHTU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Idsohtu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/idsohtu"
        date = "2026-10-16"
    strings:
        $attrib_str = "idsohtu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Iespy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/iespy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IESPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Iespy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/iespy"
        date = "2026-10-16"
    strings:
        $fam_name = "iespy" ascii wide nocase
        $alias_1 = "spyware.iespy" ascii wide nocase
        $alias_2 = "bho.iespy" ascii wide nocase
        $alias_3 = "trojan.spy.ie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IESPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Iespy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/iespy"
        date = "2026-10-16"
    strings:
        $attrib_str = "iespy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Iezones (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/iezones
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IEZONES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Iezones (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/iezones"
        date = "2026-10-16"
    strings:
        $fam_name = "iezones" ascii wide nocase
        $alias_1 = "adware.iezones" ascii wide nocase
        $alias_2 = "spyware.iezones" ascii wide nocase
        $alias_3 = "trojan.zonemap" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IEZONES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Iezones tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/iezones"
        date = "2026-10-16"
    strings:
        $attrib_str = "iezones" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ilomo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ilomo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ILOMO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ilomo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ilomo"
        date = "2026-10-16"
    strings:
        $fam_name = "ilomo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ILOMO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ilomo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ilomo"
        date = "2026-10-16"
    strings:
        $attrib_str = "ilomo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Imali (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/imali
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IMALI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Imali (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imali"
        date = "2026-10-16"
    strings:
        $fam_name = "imali" ascii wide nocase
        $alias_1 = "ransom:win32/imali" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.imali" ascii wide nocase
        $alias_3 = "win32/imali" ascii wide nocase
        $alias_4 = "ransom.imali" ascii wide nocase
        $alias_5 = "imali ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IMALI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Imali tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imali"
        date = "2026-10-16"
    strings:
        $attrib_str = "imali" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Imaut (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/imaut
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IMAUT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Imaut (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imaut"
        date = "2026-10-16"
    strings:
        $fam_name = "imaut" ascii wide nocase
        $alias_1 = "worm.imaut" ascii wide nocase
        $alias_2 = "w32/imaut" ascii wide nocase
        $alias_3 = "autorun.imaut" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IMAUT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Imaut tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imaut"
        date = "2026-10-16"
    strings:
        $attrib_str = "imaut" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Imestartup (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/imestartup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IMESTARTUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Imestartup (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imestartup"
        date = "2026-10-16"
    strings:
        $fam_name = "imestartup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IMESTARTUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Imestartup tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imestartup"
        date = "2026-10-16"
    strings:
        $attrib_str = "imestartup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Imminent (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/imminent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IMMINENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Imminent (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imminent"
        date = "2026-10-16"
    strings:
        $fam_name = "imminent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IMMINENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Imminent tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imminent"
        date = "2026-10-16"
    strings:
        $attrib_str = "imminent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Immirat (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/immirat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IMMIRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Immirat (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/immirat"
        date = "2026-10-16"
    strings:
        $fam_name = "immirat" ascii wide nocase
        $alias_1 = "trojan:win32/immirat" ascii wide nocase
        $alias_2 = "backdoor:win32/immirat" ascii wide nocase
        $alias_3 = "win32/immirat" ascii wide nocase
        $alias_4 = "immirat" ascii wide nocase
        $alias_5 = "trojan.immirat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IMMIRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Immirat tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/immirat"
        date = "2026-10-16"
    strings:
        $attrib_str = "immirat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Imps (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/imps
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IMPS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Imps (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imps"
        date = "2026-10-16"
    strings:
        $fam_name = "imps" ascii wide nocase
        $alias_1 = "trojan.imps" ascii wide nocase
        $alias_2 = "downloader.imps" ascii wide nocase
        $alias_3 = "win32/imps" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IMPS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Imps tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imps"
        date = "2026-10-16"
    strings:
        $attrib_str = "imps" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Imqaaem1Agai (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/imqaaem1agai
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IMQAAEM1AGAI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Imqaaem1Agai (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imqaaem1agai"
        date = "2026-10-16"
    strings:
        $fam_name = "imqaaem1agai" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.imqaaem1agai" ascii wide nocase
        $alias_3 = "heur.imqaaem1agai" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IMQAAEM1AGAI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Imqaaem1Agai tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/imqaaem1agai"
        date = "2026-10-16"
    strings:
        $attrib_str = "imqaaem1agai" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Inbox (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/inbox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INBOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Inbox (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inbox"
        date = "2026-10-16"
    strings:
        $fam_name = "inbox" ascii wide nocase
        $alias_1 = "browsermodifier:win32/inbox" ascii wide nocase
        $alias_2 = "adware:win32/inbox" ascii wide nocase
        $alias_3 = "pua:win32/inboxace" ascii wide nocase
        $alias_4 = "toolbar:win32/inbox" ascii wide nocase
        $alias_5 = "win32/inboxace" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INBOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Inbox tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inbox"
        date = "2026-10-16"
    strings:
        $attrib_str = "inbox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Incredimail (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/incredimail
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INCREDIMAIL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Incredimail (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/incredimail"
        date = "2026-10-16"
    strings:
        $fam_name = "incredimail" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INCREDIMAIL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Incredimail tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/incredimail"
        date = "2026-10-16"
    strings:
        $attrib_str = "incredimail" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Indigorose (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/indigorose
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INDIGOROSE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Indigorose (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/indigorose"
        date = "2026-10-16"
    strings:
        $fam_name = "indigorose" ascii wide nocase
        $alias_1 = "riskware.indigorose" ascii wide nocase
        $alias_2 = "dropper.autoplay" ascii wide nocase
        $alias_3 = "win32/autoplay.suspicious" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INDIGOROSE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Indigorose tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/indigorose"
        date = "2026-10-16"
    strings:
        $attrib_str = "indigorose" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Indiloadz (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/indiloadz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INDILOADZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Indiloadz (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/indiloadz"
        date = "2026-10-16"
    strings:
        $fam_name = "indiloadz" ascii wide nocase
        $alias_1 = "adware:win32/indiloadz" ascii wide nocase
        $alias_2 = "pua:win32/indiloadz" ascii wide nocase
        $alias_3 = "trojan:win32/indiloadz" ascii wide nocase
        $alias_4 = "pua.indiloadz" ascii wide nocase
        $alias_5 = "win32/indiloadz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INDILOADZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Indiloadz tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/indiloadz"
        date = "2026-10-16"
    strings:
        $attrib_str = "indiloadz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Induc (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/induc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INDUC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Induc (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/induc"
        date = "2026-10-16"
    strings:
        $fam_name = "induc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INDUC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Induc tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/induc"
        date = "2026-10-16"
    strings:
        $attrib_str = "induc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Inegery (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/inegery
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INEGERY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Inegery (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inegery"
        date = "2026-10-16"
    strings:
        $fam_name = "inegery" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INEGERY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Inegery tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inegery"
        date = "2026-10-16"
    strings:
        $attrib_str = "inegery" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Inexsmar (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/inexsmar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INEXSMAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Inexsmar (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inexsmar"
        date = "2026-10-16"
    strings:
        $fam_name = "inexsmar" ascii wide nocase
        $alias_1 = "trojan.inexsmar" ascii wide nocase
        $alias_2 = "downloader.inexsmar" ascii wide nocase
        $alias_3 = "win32/inexsmar.a" ascii wide nocase
        $alias_4 = "darkhotel.dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INEXSMAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Inexsmar tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inexsmar"
        date = "2026-10-16"
    strings:
        $attrib_str = "inexsmar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Infector_Ng_2004 (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/infector_ng_2004
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INFECTOR_NG_2004_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Infector_Ng_2004 (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/infector_ng_2004"
        date = "2026-10-16"
    strings:
        $fam_name = "infector_ng_2004" ascii wide nocase
        $alias_1 = "trojan:win32/infectorng2004" ascii wide nocase
        $alias_2 = "virus:win32/infectorng" ascii wide nocase
        $alias_3 = "trojan.win32.infector" ascii wide nocase
        $alias_4 = "win32/infectorng.trojan" ascii wide nocase
        $alias_5 = "infectorng.2004" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INFECTOR_NG_2004_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Infector_Ng_2004 tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/infector_ng_2004"
        date = "2026-10-16"
    strings:
        $attrib_str = "infector_ng_2004" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Infinitetear (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/infinitetear
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INFINITETEAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Infinitetear (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/infinitetear"
        date = "2026-10-16"
    strings:
        $fam_name = "infinitetear" ascii wide nocase
        $alias_1 = "backdoor.infinitetear" ascii wide nocase
        $alias_2 = "apt.infinitetear" ascii wide nocase
        $alias_3 = "trojan.tear" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INFINITETEAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Infinitetear tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/infinitetear"
        date = "2026-10-16"
    strings:
        $attrib_str = "infinitetear" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Informer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/informer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INFORMER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Informer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/informer"
        date = "2026-10-16"
    strings:
        $fam_name = "informer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INFORMER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Informer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/informer"
        date = "2026-10-16"
    strings:
        $attrib_str = "informer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Injeber (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/injeber
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INJEBER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Injeber (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/injeber"
        date = "2026-10-16"
    strings:
        $fam_name = "injeber" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INJEBER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Injeber tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/injeber"
        date = "2026-10-16"
    strings:
        $attrib_str = "injeber" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Injectorlib (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/injectorlib
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INJECTORLIB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Injectorlib (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/injectorlib"
        date = "2026-10-16"
    strings:
        $fam_name = "injectorlib" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INJECTORLIB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Injectorlib tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/injectorlib"
        date = "2026-10-16"
    strings:
        $attrib_str = "injectorlib" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Inno (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/inno
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INNO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Inno (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inno"
        date = "2026-10-16"
    strings:
        $fam_name = "inno" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INNO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Inno tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inno"
        date = "2026-10-16"
    strings:
        $attrib_str = "inno" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Innomod (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/innomod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INNOMOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Innomod (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/innomod"
        date = "2026-10-16"
    strings:
        $fam_name = "innomod" ascii wide nocase
        $alias_1 = "adware.innomod" ascii wide nocase
        $alias_2 = "pup.innomod" ascii wide nocase
        $alias_3 = "browsermodifier:win32/innomod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INNOMOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Innomod tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/innomod"
        date = "2026-10-16"
    strings:
        $attrib_str = "innomod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Inor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/inor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Inor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inor"
        date = "2026-10-16"
    strings:
        $fam_name = "inor" ascii wide nocase
        $alias_1 = "trojan.inor" ascii wide nocase
        $alias_2 = "downloader.inor" ascii wide nocase
        $alias_3 = "win32/inor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Inor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inor"
        date = "2026-10-16"
    strings:
        $attrib_str = "inor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Inrogatio (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/inrogatio
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INROGATIO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Inrogatio (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inrogatio"
        date = "2026-10-16"
    strings:
        $fam_name = "inrogatio" ascii wide nocase
        $alias_1 = "trojan.inrogatio" ascii wide nocase
        $alias_2 = "downloader.inrogatio" ascii wide nocase
        $alias_3 = "win32/inrogatio" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INROGATIO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Inrogatio tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inrogatio"
        date = "2026-10-16"
    strings:
        $attrib_str = "inrogatio" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Insebro (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/insebro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSEBRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Insebro (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/insebro"
        date = "2026-10-16"
    strings:
        $fam_name = "insebro" ascii wide nocase
        $alias_1 = "trojan.insebro" ascii wide nocase
        $alias_2 = "downloader.insebro" ascii wide nocase
        $alias_3 = "win32/insebro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSEBRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Insebro tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/insebro"
        date = "2026-10-16"
    strings:
        $attrib_str = "insebro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Inservice (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/inservice
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSERVICE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Inservice (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inservice"
        date = "2026-10-16"
    strings:
        $fam_name = "inservice" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSERVICE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Inservice tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/inservice"
        date = "2026-10-16"
    strings:
        $attrib_str = "inservice" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Installbar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installbar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installbar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installbar"
        date = "2026-10-16"
    strings:
        $fam_name = "installbar" ascii wide nocase
        $alias_1 = "adware.installbar" ascii wide nocase
        $alias_2 = "pup.installbar" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installbar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installbar"
        date = "2026-10-16"
    strings:
        $attrib_str = "installbar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Installbrain (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installbrain
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLBRAIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installbrain (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installbrain"
        date = "2026-10-16"
    strings:
        $fam_name = "installbrain" ascii wide nocase
        $alias_1 = "adware:win32/installbrain" ascii wide nocase
        $alias_2 = "pua:win32/installbrain" ascii wide nocase
        $alias_3 = "program:win32/installbrain" ascii wide nocase
        $alias_4 = "installbrain bundler" ascii wide nocase
        $alias_5 = "win32/installbrain" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLBRAIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installbrain tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installbrain"
        date = "2026-10-16"
    strings:
        $attrib_str = "installbrain" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Installcore (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installcore
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLCORE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installcore (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installcore"
        date = "2026-10-16"
    strings:
        $fam_name = "installcore" ascii wide nocase
        $alias_1 = "installcore" ascii wide nocase
        $alias_2 = "pua:win32/installcore" ascii wide nocase
        $alias_3 = "adw_installcore" ascii wide nocase
        $alias_4 = "pup.optional.installcore" ascii wide nocase
        $alias_5 = "pua.win32.installcore" ascii wide nocase
        $alias_6 = "installcore bundler" ascii wide nocase
        $alias_7 = "adware.installcore" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLCORE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installcore tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installcore"
        date = "2026-10-16"
    strings:
        $attrib_str = "installcore" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Installerex (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installerex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLEREX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installerex (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installerex"
        date = "2026-10-16"
    strings:
        $fam_name = "installerex" ascii wide nocase
        $alias_1 = "adware:win32/installerex" ascii wide nocase
        $alias_2 = "softwarebundler:win32/installerex" ascii wide nocase
        $alias_3 = "pua:win32/installerex" ascii wide nocase
        $alias_4 = "win32/installerex" ascii wide nocase
        $alias_5 = "adware.installerex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLEREX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installerex tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installerex"
        date = "2026-10-16"
    strings:
        $attrib_str = "installerex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Installermonetizer (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installermonetizer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLERMONETIZER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installermonetizer (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installermonetizer"
        date = "2026-10-16"
    strings:
        $fam_name = "installermonetizer" ascii wide nocase
        $alias_1 = "adware:win32/installermonetizer" ascii wide nocase
        $alias_2 = "pua:win32/installermonetizer" ascii wide nocase
        $alias_3 = "program:win32/installermonetizer" ascii wide nocase
        $alias_4 = "installermonetizer bundler" ascii wide nocase
        $alias_5 = "win32/installermonetizer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLERMONETIZER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installermonetizer tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installermonetizer"
        date = "2026-10-16"
    strings:
        $attrib_str = "installermonetizer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Installflash (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installflash
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLFLASH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installflash (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installflash"
        date = "2026-10-16"
    strings:
        $fam_name = "installflash" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLFLASH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installflash tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installflash"
        date = "2026-10-16"
    strings:
        $attrib_str = "installflash" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Installiq (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installiq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLIQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installiq (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installiq"
        date = "2026-10-16"
    strings:
        $fam_name = "installiq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLIQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installiq tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installiq"
        date = "2026-10-16"
    strings:
        $attrib_str = "installiq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Installm (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installm (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installm"
        date = "2026-10-16"
    strings:
        $fam_name = "installm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installm tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installm"
        date = "2026-10-16"
    strings:
        $attrib_str = "installm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Installmate (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installmate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLMATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installmate (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installmate"
        date = "2026-10-16"
    strings:
        $fam_name = "installmate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLMATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installmate tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installmate"
        date = "2026-10-16"
    strings:
        $attrib_str = "installmate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Installmetrix (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installmetrix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLMETRIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installmetrix (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installmetrix"
        date = "2026-10-16"
    strings:
        $fam_name = "installmetrix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLMETRIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installmetrix tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installmetrix"
        date = "2026-10-16"
    strings:
        $attrib_str = "installmetrix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Installmonetizer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installmonetizer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLMONETIZER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installmonetizer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installmonetizer"
        date = "2026-10-16"
    strings:
        $fam_name = "installmonetizer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLMONETIZER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installmonetizer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installmonetizer"
        date = "2026-10-16"
    strings:
        $attrib_str = "installmonetizer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Installmonster (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installmonster
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLMONSTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installmonster (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installmonster"
        date = "2026-10-16"
    strings:
        $fam_name = "installmonster" ascii wide nocase
        $alias_1 = "adware.installmonster" ascii wide nocase
        $alias_2 = "pua:win32/installmonster" ascii wide nocase
        $alias_3 = "trojan.installmonster" ascii wide nocase
        $alias_4 = "win32/amonetize.bundler" ascii wide nocase
        $alias_5 = "pup.optional.installmonster" ascii wide nocase
        $alias_6 = "installcube" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLMONSTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installmonster tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installmonster"
        date = "2026-10-16"
    strings:
        $attrib_str = "installmonster" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Installpack (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installpack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLPACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installpack (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installpack"
        date = "2026-10-16"
    strings:
        $fam_name = "installpack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLPACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installpack tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installpack"
        date = "2026-10-16"
    strings:
        $attrib_str = "installpack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Installtoolbar (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/installtoolbar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLTOOLBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Installtoolbar (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installtoolbar"
        date = "2026-10-16"
    strings:
        $fam_name = "installtoolbar" ascii wide nocase
        $alias_1 = "browsermodifier:win32/installtoolbar" ascii wide nocase
        $alias_2 = "adware:win32/installtoolbar" ascii wide nocase
        $alias_3 = "pua:win32/installtoolbar" ascii wide nocase
        $alias_4 = "win32/installtoolbar" ascii wide nocase
        $alias_5 = "installtoolbar bundler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLTOOLBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Installtoolbar tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/installtoolbar"
        date = "2026-10-16"
    strings:
        $attrib_str = "installtoolbar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Instally (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/instally
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTALLY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Instally (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/instally"
        date = "2026-10-16"
    strings:
        $fam_name = "instally" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTALLY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Instally tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/instally"
        date = "2026-10-16"
    strings:
        $attrib_str = "instally" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Institution_2004 (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/institution_2004
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTITUTION_2004_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Institution_2004 (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/institution_2004"
        date = "2026-10-16"
    strings:
        $fam_name = "institution_2004" ascii wide nocase
        $alias_1 = "trojan:win32/institution2004" ascii wide nocase
        $alias_2 = "backdoor.win32.institution" ascii wide nocase
        $alias_3 = "trojan.institution" ascii wide nocase
        $alias_4 = "win32/institution.rat" ascii wide nocase
        $alias_5 = "institution.2004.backdoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTITUTION_2004_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Institution_2004 tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/institution_2004"
        date = "2026-10-16"
    strings:
        $attrib_str = "institution_2004" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Instmonster (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/instmonster
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INSTMONSTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Instmonster (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/instmonster"
        date = "2026-10-16"
    strings:
        $fam_name = "instmonster" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INSTMONSTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Instmonster tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/instmonster"
        date = "2026-10-16"
    strings:
        $attrib_str = "instmonster" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Invader (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/invader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_INVADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Invader (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/invader"
        date = "2026-10-16"
    strings:
        $fam_name = "invader" ascii wide nocase
        $alias_1 = "virus:win32/invader" ascii wide nocase
        $alias_2 = "trojan:win32/invader" ascii wide nocase
        $alias_3 = "virus.win32.invader" ascii wide nocase
        $alias_4 = "win32/invader" ascii wide nocase
        $alias_5 = "w32/invader.virus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_INVADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Invader tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/invader"
        date = "2026-10-16"
    strings:
        $attrib_str = "invader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Iobit (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/iobit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IOBIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Iobit (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/iobit"
        date = "2026-10-16"
    strings:
        $fam_name = "iobit" ascii wide nocase
        $alias_1 = "pua:win32/iobit" ascii wide nocase
        $alias_2 = "program:win32/iobit" ascii wide nocase
        $alias_3 = "win32/iobit" ascii wide nocase
        $alias_4 = "iobit advanced systemcare" ascii wide nocase
        $alias_5 = "pua.iobit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IOBIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Iobit tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/iobit"
        date = "2026-10-16"
    strings:
        $attrib_str = "iobit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ipamor (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ipamor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IPAMOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ipamor (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ipamor"
        date = "2026-10-16"
    strings:
        $fam_name = "ipamor" ascii wide nocase
        $alias_1 = "backdoor:win32/ipamor" ascii wide nocase
        $alias_2 = "trojan:win32/ipamor!rfn" ascii wide nocase
        $alias_3 = "trojan.win32.ipamor" ascii wide nocase
        $alias_4 = "pe_ipamor" ascii wide nocase
        $alias_5 = "win32/ipamor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IPAMOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ipamor tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ipamor"
        date = "2026-10-16"
    strings:
        $attrib_str = "ipamor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Ipswitch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ipswitch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IPSWITCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ipswitch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ipswitch"
        date = "2026-10-16"
    strings:
        $fam_name = "ipswitch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IPSWITCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ipswitch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ipswitch"
        date = "2026-10-16"
    strings:
        $attrib_str = "ipswitch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ircbot (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ircbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IRCBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ircbot (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ircbot"
        date = "2026-10-16"
    strings:
        $fam_name = "ircbot" ascii wide nocase
        $alias_1 = "ircbot" ascii wide nocase
        $alias_2 = "backdoor:win32/ircbot" ascii wide nocase
        $alias_3 = "w32.ircbot" ascii wide nocase
        $alias_4 = "backdoor.irc.bot" ascii wide nocase
        $alias_5 = "trojan.irc.zapchast" ascii wide nocase
        $alias_6 = "win32/ircbot" ascii wide nocase
        $alias_7 = "irc-worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IRCBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ircbot tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ircbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "ircbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Ircbrute (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ircbrute
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IRCBRUTE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ircbrute (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ircbrute"
        date = "2026-10-16"
    strings:
        $fam_name = "ircbrute" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IRCBRUTE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ircbrute tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ircbrute"
        date = "2026-10-16"
    strings:
        $attrib_str = "ircbrute" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ircfast (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ircfast
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IRCFAST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ircfast (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ircfast"
        date = "2026-10-16"
    strings:
        $fam_name = "ircfast" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IRCFAST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ircfast tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ircfast"
        date = "2026-10-16"
    strings:
        $attrib_str = "ircfast" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ircnite (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ircnite
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IRCNITE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ircnite (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ircnite"
        date = "2026-10-16"
    strings:
        $fam_name = "ircnite" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IRCNITE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ircnite tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ircnite"
        date = "2026-10-16"
    strings:
        $attrib_str = "ircnite" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Irplan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/irplan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IRPLAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Irplan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/irplan"
        date = "2026-10-16"
    strings:
        $fam_name = "irplan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IRPLAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Irplan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/irplan"
        date = "2026-10-16"
    strings:
        $attrib_str = "irplan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Isnev (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/isnev
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ISNEV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Isnev (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/isnev"
        date = "2026-10-16"
    strings:
        $fam_name = "isnev" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ISNEV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Isnev tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/isnev"
        date = "2026-10-16"
    strings:
        $attrib_str = "isnev" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Isof (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/isof
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ISOF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Isof (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/isof"
        date = "2026-10-16"
    strings:
        $fam_name = "isof" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ISOF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Isof tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/isof"
        date = "2026-10-16"
    strings:
        $attrib_str = "isof" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Istartsurf (Browser_Hijacker)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/istartsurf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ISTARTSURF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Istartsurf (Browser_Hijacker)"
        category = "Browser_Hijacker"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/istartsurf"
        date = "2026-10-16"
    strings:
        $fam_name = "istartsurf" ascii wide nocase
        $alias_1 = "browsermodifier:win32/istartsurf" ascii wide nocase
        $alias_2 = "adware:win32/istartsurf" ascii wide nocase
        $alias_3 = "win32/istartsurf" ascii wide nocase
        $alias_4 = "pup.optional.istartsurf" ascii wide nocase
        $alias_5 = "istartsurf.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ISTARTSURF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Istartsurf tradecraft"
        category = "Browser_Hijacker"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/istartsurf"
        date = "2026-10-16"
    strings:
        $attrib_str = "istartsurf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Istartsurfinstaller (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/istartsurfinstaller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ISTARTSURFINSTALLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Istartsurfinstaller (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/istartsurfinstaller"
        date = "2026-10-16"
    strings:
        $fam_name = "istartsurfinstaller" ascii wide nocase
        $alias_1 = "adware.istartsurf" ascii wide nocase
        $alias_2 = "pup.istartsurfinstaller" ascii wide nocase
        $alias_3 = "browsermodifier:win32/istartsurf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ISTARTSURFINSTALLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Istartsurfinstaller tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/istartsurfinstaller"
        date = "2026-10-16"
    strings:
        $attrib_str = "istartsurfinstaller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Istbar (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/istbar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ISTBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Istbar (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/istbar"
        date = "2026-10-16"
    strings:
        $fam_name = "istbar" ascii wide nocase
        $alias_1 = "adware.istbar" ascii wide nocase
        $alias_2 = "toolbar.ist" ascii wide nocase
        $alias_3 = "browsermodifier:win32/istbar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ISTBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Istbar tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/istbar"
        date = "2026-10-16"
    strings:
        $attrib_str = "istbar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Itorrent (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/itorrent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ITORRENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Itorrent (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/itorrent"
        date = "2026-10-16"
    strings:
        $fam_name = "itorrent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ITORRENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Itorrent tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/itorrent"
        date = "2026-10-16"
    strings:
        $attrib_str = "itorrent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Itranslator (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/itranslator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ITRANSLATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Itranslator (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/itranslator"
        date = "2026-10-16"
    strings:
        $fam_name = "itranslator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ITRANSLATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Itranslator tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/itranslator"
        date = "2026-10-16"
    strings:
        $attrib_str = "itranslator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Itva (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/itva
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ITVA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Itva (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/itva"
        date = "2026-10-16"
    strings:
        $fam_name = "itva" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ITVA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Itva tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/itva"
        date = "2026-10-16"
    strings:
        $attrib_str = "itva" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Iwin (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/iwin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_IWIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Iwin (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/iwin"
        date = "2026-10-16"
    strings:
        $fam_name = "iwin" ascii wide nocase
        $alias_1 = "adware.iwin" ascii wide nocase
        $alias_2 = "pup.iwin" ascii wide nocase
        $alias_3 = "browsermodifier:win32/iwin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_IWIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Iwin tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/iwin"
        date = "2026-10-16"
    strings:
        $attrib_str = "iwin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Jacard (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jacard
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JACARD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jacard (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jacard"
        date = "2026-10-16"
    strings:
        $fam_name = "jacard" ascii wide nocase
        $alias_1 = "trojan:win32/jacard" ascii wide nocase
        $alias_2 = "trojan.jacard" ascii wide nocase
        $alias_3 = "w32/jacard" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JACARD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jacard tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jacard"
        date = "2026-10-16"
    strings:
        $attrib_str = "jacard" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Jacksbot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jacksbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JACKSBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jacksbot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jacksbot"
        date = "2026-10-16"
    strings:
        $fam_name = "jacksbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JACKSBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jacksbot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jacksbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "jacksbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Jackservn (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jackservn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JACKSERVN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jackservn (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jackservn"
        date = "2026-10-16"
    strings:
        $fam_name = "jackservn" ascii wide nocase
        $alias_1 = "trojan:win32/jackservn" ascii wide nocase
        $alias_2 = "trojandownloader:win32/jackservn" ascii wide nocase
        $alias_3 = "win32/jackservn" ascii wide nocase
        $alias_4 = "jackservn loader" ascii wide nocase
        $alias_5 = "trojan.jackservn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JACKSERVN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jackservn tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jackservn"
        date = "2026-10-16"
    strings:
        $attrib_str = "jackservn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Jaik (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jaik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JAIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jaik (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jaik"
        date = "2026-10-16"
    strings:
        $fam_name = "jaik" ascii wide nocase
        $alias_1 = "trojan:win32/jaik" ascii wide nocase
        $alias_2 = "trojan:win32/jaik!pz" ascii wide nocase
        $alias_3 = "trojan:win32/jaik!mtb" ascii wide nocase
        $alias_4 = "win32/jaik" ascii wide nocase
        $alias_5 = "trojan.win32.jaik" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JAIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jaik tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jaik"
        date = "2026-10-16"
    strings:
        $attrib_str = "jaik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Jaike (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jaike
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JAIKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jaike (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jaike"
        date = "2026-10-16"
    strings:
        $fam_name = "jaike" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JAIKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jaike tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jaike"
        date = "2026-10-16"
    strings:
        $attrib_str = "jaike" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jaiko (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jaiko
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JAIKO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jaiko (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jaiko"
        date = "2026-10-16"
    strings:
        $fam_name = "jaiko" ascii wide nocase
        $alias_1 = "ransom:win32/jaiko" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.jaiko" ascii wide nocase
        $alias_3 = "ransom.jaiko" ascii wide nocase
        $alias_4 = "win32/jaiko" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JAIKO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jaiko tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jaiko"
        date = "2026-10-16"
    strings:
        $attrib_str = "jaiko" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jaiks (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jaiks
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JAIKS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jaiks (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jaiks"
        date = "2026-10-16"
    strings:
        $fam_name = "jaiks" ascii wide nocase
        $alias_1 = "ransom:win32/jaiks" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.jaiks" ascii wide nocase
        $alias_3 = "win32/jaiks" ascii wide nocase
        $alias_4 = "jaiks ransomware" ascii wide nocase
        $alias_5 = "ransom.jaiks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JAIKS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jaiks tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jaiks"
        date = "2026-10-16"
    strings:
        $attrib_str = "jaiks" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jakuz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jakuz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JAKUZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jakuz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jakuz"
        date = "2026-10-16"
    strings:
        $fam_name = "jakuz" ascii wide nocase
        $alias_1 = "trojan.jakuz" ascii wide nocase
        $alias_2 = "downloader.jakuz" ascii wide nocase
        $alias_3 = "win32/jakuz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JAKUZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jakuz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jakuz"
        date = "2026-10-16"
    strings:
        $attrib_str = "jakuz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jakyllhyde (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jakyllhyde
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JAKYLLHYDE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jakyllhyde (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jakyllhyde"
        date = "2026-10-16"
    strings:
        $fam_name = "jakyllhyde" ascii wide nocase
        $alias_1 = "trojan.jakyllhyde" ascii wide nocase
        $alias_2 = "evasive.jakyllhyde" ascii wide nocase
        $alias_3 = "win32/jakyllhyde" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JAKYLLHYDE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jakyllhyde tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jakyllhyde"
        date = "2026-10-16"
    strings:
        $attrib_str = "jakyllhyde" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jatif (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jatif
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JATIF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jatif (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jatif"
        date = "2026-10-16"
    strings:
        $fam_name = "jatif" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JATIF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jatif tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jatif"
        date = "2026-10-16"
    strings:
        $attrib_str = "jatif" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jawego (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jawego
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JAWEGO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jawego (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jawego"
        date = "2026-10-16"
    strings:
        $fam_name = "jawego" ascii wide nocase
        $alias_1 = "adware:win32/jawego" ascii wide nocase
        $alias_2 = "pua:win32/jawego" ascii wide nocase
        $alias_3 = "trojan.win32.jawego" ascii wide nocase
        $alias_4 = "win32/jawego" ascii wide nocase
        $alias_5 = "adware.jawego" ascii wide nocase
        $alias_6 = "adware:win32/jawego.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JAWEGO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jawego tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jawego"
        date = "2026-10-16"
    strings:
        $attrib_str = "jawego" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Jbomi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jbomi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JBOMI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jbomi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jbomi"
        date = "2026-10-16"
    strings:
        $fam_name = "jbomi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JBOMI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jbomi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jbomi"
        date = "2026-10-16"
    strings:
        $attrib_str = "jbomi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jbonblanc (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jbonblanc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JBONBLANC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jbonblanc (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jbonblanc"
        date = "2026-10-16"
    strings:
        $fam_name = "jbonblanc" ascii wide nocase
        $alias_1 = "trojan:win32/jbonblanc" ascii wide nocase
        $alias_2 = "backdoor.win32.jbonblanc" ascii wide nocase
        $alias_3 = "trojan.jbonblanc" ascii wide nocase
        $alias_4 = "win32/jbonblanc.rat" ascii wide nocase
        $alias_5 = "backdoor.jbonblanc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JBONBLANC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jbonblanc tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jbonblanc"
        date = "2026-10-16"
    strings:
        $attrib_str = "jbonblanc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Jeefo (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jeefo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JEEFO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jeefo (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jeefo"
        date = "2026-10-16"
    strings:
        $fam_name = "jeefo" ascii wide nocase
        $alias_1 = "virus:win32/jeefo.a" ascii wide nocase
        $alias_2 = "pe_jeefo.a" ascii wide nocase
        $alias_3 = "virus.win32.hidrag.a" ascii wide nocase
        $alias_4 = "w32/jeefo" ascii wide nocase
        $alias_5 = "win32.jeefo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JEEFO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jeefo tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jeefo"
        date = "2026-10-16"
    strings:
        $attrib_str = "jeefo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Jenxcus (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jenxcus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JENXCUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jenxcus (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jenxcus"
        date = "2026-10-16"
    strings:
        $fam_name = "jenxcus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JENXCUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jenxcus tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jenxcus"
        date = "2026-10-16"
    strings:
        $attrib_str = "jenxcus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Jetmedia (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jetmedia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JETMEDIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jetmedia (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jetmedia"
        date = "2026-10-16"
    strings:
        $fam_name = "jetmedia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JETMEDIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jetmedia tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jetmedia"
        date = "2026-10-16"
    strings:
        $attrib_str = "jetmedia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Jevafus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jevafus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JEVAFUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jevafus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jevafus"
        date = "2026-10-16"
    strings:
        $fam_name = "jevafus" ascii wide nocase
        $alias_1 = "trojan.jevafus" ascii wide nocase
        $alias_2 = "downloader.jevafus" ascii wide nocase
        $alias_3 = "win32/jevafus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JEVAFUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jevafus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jevafus"
        date = "2026-10-16"
    strings:
        $attrib_str = "jevafus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jhee (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jhee
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JHEE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jhee (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jhee"
        date = "2026-10-16"
    strings:
        $fam_name = "jhee" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JHEE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jhee tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jhee"
        date = "2026-10-16"
    strings:
        $attrib_str = "jhee" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jigsaw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jigsaw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JIGSAW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jigsaw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jigsaw"
        date = "2026-10-16"
    strings:
        $fam_name = "jigsaw" ascii wide nocase
        $alias_1 = "ransom:win32/jigsaw" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.jigsaw" ascii wide nocase
        $alias_3 = "win32/jigsaw" ascii wide nocase
        $alias_4 = "bitcoinblackmailer" ascii wide nocase
        $alias_5 = "jigsaw ransomware" ascii wide nocase
        $alias_6 = "saw ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JIGSAW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jigsaw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jigsaw"
        date = "2026-10-16"
    strings:
        $attrib_str = "jigsaw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jigsawlocker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jigsawlocker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JIGSAWLOCKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jigsawlocker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jigsawlocker"
        date = "2026-10-16"
    strings:
        $fam_name = "jigsawlocker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JIGSAWLOCKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jigsawlocker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jigsawlocker"
        date = "2026-10-16"
    strings:
        $attrib_str = "jigsawlocker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jimmy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jimmy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JIMMY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jimmy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jimmy"
        date = "2026-10-16"
    strings:
        $fam_name = "jimmy" ascii wide nocase
        $alias_1 = "ransom:win32/jimmy" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.jimmy" ascii wide nocase
        $alias_3 = "ransom.jimmy" ascii wide nocase
        $alias_4 = "win32/jimmy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JIMMY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jimmy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jimmy"
        date = "2026-10-16"
    strings:
        $attrib_str = "jimmy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jinda (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jinda
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JINDA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jinda (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jinda"
        date = "2026-10-16"
    strings:
        $fam_name = "jinda" ascii wide nocase
        $alias_1 = "trojan.jinda" ascii wide nocase
        $alias_2 = "downloader.jinda" ascii wide nocase
        $alias_3 = "win32/jinda" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JINDA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jinda tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jinda"
        date = "2026-10-16"
    strings:
        $attrib_str = "jinda" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jintor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jintor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JINTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jintor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jintor"
        date = "2026-10-16"
    strings:
        $fam_name = "jintor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JINTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jintor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jintor"
        date = "2026-10-16"
    strings:
        $attrib_str = "jintor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jnkfasgyvyo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jnkfasgyvyo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JNKFASGYVYO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jnkfasgyvyo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jnkfasgyvyo"
        date = "2026-10-16"
    strings:
        $fam_name = "jnkfasgyvyo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JNKFASGYVYO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jnkfasgyvyo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jnkfasgyvyo"
        date = "2026-10-16"
    strings:
        $attrib_str = "jnkfasgyvyo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jo0Br8Hglsii (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jo0br8hglsii
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JO0BR8HGLSII_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jo0Br8Hglsii (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jo0br8hglsii"
        date = "2026-10-16"
    strings:
        $fam_name = "jo0br8hglsii" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JO0BR8HGLSII_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jo0Br8Hglsii tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jo0br8hglsii"
        date = "2026-10-16"
    strings:
        $attrib_str = "jo0br8hglsii" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jobaka (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jobaka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JOBAKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jobaka (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jobaka"
        date = "2026-10-16"
    strings:
        $fam_name = "jobaka" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JOBAKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jobaka tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jobaka"
        date = "2026-10-16"
    strings:
        $attrib_str = "jobaka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jobcrypter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jobcrypter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JOBCRYPTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jobcrypter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jobcrypter"
        date = "2026-10-16"
    strings:
        $fam_name = "jobcrypter" ascii wide nocase
        $alias_1 = "ransom.jobcrypter" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.jobcrypter" ascii wide nocase
        $alias_3 = "win32/filecoder.jobcrypter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JOBCRYPTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jobcrypter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jobcrypter"
        date = "2026-10-16"
    strings:
        $attrib_str = "jobcrypter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Johnnie (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/johnnie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JOHNNIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Johnnie (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/johnnie"
        date = "2026-10-16"
    strings:
        $fam_name = "johnnie" ascii wide nocase
        $alias_1 = "trojan:win32/johnnie" ascii wide nocase
        $alias_2 = "hacktool:win32/johnnie" ascii wide nocase
        $alias_3 = "worm:win32/johnnie" ascii wide nocase
        $alias_4 = "win32/johnnie.a" ascii wide nocase
        $alias_5 = "johnnie.tool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JOHNNIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Johnnie tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/johnnie"
        date = "2026-10-16"
    strings:
        $attrib_str = "johnnie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Joiner (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/joiner
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JOINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Joiner (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/joiner"
        date = "2026-10-16"
    strings:
        $fam_name = "joiner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JOINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Joiner tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/joiner"
        date = "2026-10-16"
    strings:
        $attrib_str = "joiner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Joke (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/joke
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JOKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Joke (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/joke"
        date = "2026-10-16"
    strings:
        $fam_name = "joke" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JOKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Joke tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/joke"
        date = "2026-10-16"
    strings:
        $attrib_str = "joke" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Joker (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/joker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JOKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Joker (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/joker"
        date = "2026-10-16"
    strings:
        $fam_name = "joker" ascii wide nocase
        $alias_1 = "android.joker" ascii wide nocase
        $alias_2 = "trojan.androidos.joker" ascii wide nocase
        $alias_3 = "trojan:android/joker" ascii wide nocase
        $alias_4 = "bread.spyware" ascii wide nocase
        $alias_5 = "android/joker.billingfraud" ascii wide nocase
        $alias_6 = "bread" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JOKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Joker tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/joker"
        date = "2026-10-16"
    strings:
        $attrib_str = "joker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Joosoft (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/joosoft
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JOOSOFT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Joosoft (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/joosoft"
        date = "2026-10-16"
    strings:
        $fam_name = "joosoft" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JOOSOFT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Joosoft tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/joosoft"
        date = "2026-10-16"
    strings:
        $attrib_str = "joosoft" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Jord (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jord
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JORD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jord (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jord"
        date = "2026-10-16"
    strings:
        $fam_name = "jord" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JORD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jord tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jord"
        date = "2026-10-16"
    strings:
        $attrib_str = "jord" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jottix (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jottix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JOTTIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jottix (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jottix"
        date = "2026-10-16"
    strings:
        $fam_name = "jottix" ascii wide nocase
        $alias_1 = "ransom:win32/jottix" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.jottix" ascii wide nocase
        $alias_3 = "win32/jottix" ascii wide nocase
        $alias_4 = "jottix ransomware" ascii wide nocase
        $alias_5 = "ransom.jottix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JOTTIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jottix tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jottix"
        date = "2026-10-16"
    strings:
        $attrib_str = "jottix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jps (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jps
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JPS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jps (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jps"
        date = "2026-10-16"
    strings:
        $fam_name = "jps" ascii wide nocase
        $alias_1 = "trojan:win32/jps" ascii wide nocase
        $alias_2 = "virus:win32/jps" ascii wide nocase
        $alias_3 = "trojan.win32.jps" ascii wide nocase
        $alias_4 = "win32/jps.trojan" ascii wide nocase
        $alias_5 = "jps.client" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JPS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jps tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jps"
        date = "2026-10-16"
    strings:
        $attrib_str = "jps" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Jps_Virus_Maker (Tool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jps_virus_maker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JPS_VIRUS_MAKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jps_Virus_Maker (Tool)"
        category = "Tool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jps_virus_maker"
        date = "2026-10-16"
    strings:
        $fam_name = "jps_virus_maker" ascii wide nocase
        $alias_1 = "hacktool:win32/jpsvirusmaker" ascii wide nocase
        $alias_2 = "tool:win32/jps" ascii wide nocase
        $alias_3 = "constructor.win32.jps" ascii wide nocase
        $alias_4 = "win32/jps.constructor" ascii wide nocase
        $alias_5 = "jpsvirusmaker.tool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JPS_VIRUS_MAKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jps_Virus_Maker tradecraft"
        category = "Tool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jps_virus_maker"
        date = "2026-10-16"
    strings:
        $attrib_str = "jps_virus_maker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Jscriptwrap (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jscriptwrap
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JSCRIPTWRAP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jscriptwrap (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jscriptwrap"
        date = "2026-10-16"
    strings:
        $fam_name = "jscriptwrap" ascii wide nocase
        $alias_1 = "trojan.jscriptwrap" ascii wide nocase
        $alias_2 = "dropper.jscript" ascii wide nocase
        $alias_3 = "script.obfuscated" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JSCRIPTWRAP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jscriptwrap tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jscriptwrap"
        date = "2026-10-16"
    strings:
        $attrib_str = "jscriptwrap" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Juicypotato (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/juicypotato
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JUICYPOTATO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Juicypotato (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/juicypotato"
        date = "2026-10-16"
    strings:
        $fam_name = "juicypotato" ascii wide nocase
        $alias_1 = "hacktool.juicypotato" ascii wide nocase
        $alias_2 = "riskware.juicypotato" ascii wide nocase
        $alias_3 = "exploit.lpe.juicypotato" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JUICYPOTATO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Juicypotato tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/juicypotato"
        date = "2026-10-16"
    strings:
        $attrib_str = "juicypotato" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Jumpta (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jumpta
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JUMPTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jumpta (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jumpta"
        date = "2026-10-16"
    strings:
        $fam_name = "jumpta" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JUMPTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jumpta tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jumpta"
        date = "2026-10-16"
    strings:
        $attrib_str = "jumpta" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Juntador (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/juntador
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JUNTADOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Juntador (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/juntador"
        date = "2026-10-16"
    strings:
        $fam_name = "juntador" ascii wide nocase
        $alias_1 = "trojan.binder.juntador" ascii wide nocase
        $alias_2 = "hacktool.joiner" ascii wide nocase
        $alias_3 = "win32/juntador" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JUNTADOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Juntador tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/juntador"
        date = "2026-10-16"
    strings:
        $attrib_str = "juntador" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Jusabli (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jusabli
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JUSABLI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jusabli (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jusabli"
        date = "2026-10-16"
    strings:
        $fam_name = "jusabli" ascii wide nocase
        $alias_1 = "trojan.jusabli" ascii wide nocase
        $alias_2 = "downloader.jusabli" ascii wide nocase
        $alias_3 = "win32/jusabli" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JUSABLI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jusabli tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jusabli"
        date = "2026-10-16"
    strings:
        $attrib_str = "jusabli" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jyfi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jyfi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JYFI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jyfi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jyfi"
        date = "2026-10-16"
    strings:
        $fam_name = "jyfi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JYFI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jyfi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jyfi"
        date = "2026-10-16"
    strings:
        $attrib_str = "jyfi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Jyuqet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/jyuqet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_JYUQET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Jyuqet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jyuqet"
        date = "2026-10-16"
    strings:
        $fam_name = "jyuqet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_JYUQET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Jyuqet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/jyuqet"
        date = "2026-10-16"
    strings:
        $attrib_str = "jyuqet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kabymj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kabymj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KABYMJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kabymj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kabymj"
        date = "2026-10-16"
    strings:
        $fam_name = "kabymj" ascii wide nocase
        $alias_1 = "trojan.kabymj" ascii wide nocase
        $alias_2 = "downloader.kabymj" ascii wide nocase
        $alias_3 = "win32/kabymj" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KABYMJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kabymj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kabymj"
        date = "2026-10-16"
    strings:
        $attrib_str = "kabymj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kapucen (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kapucen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KAPUCEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kapucen (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kapucen"
        date = "2026-10-16"
    strings:
        $fam_name = "kapucen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KAPUCEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kapucen tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kapucen"
        date = "2026-10-16"
    strings:
        $attrib_str = "kapucen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Karagany (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/karagany
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KARAGANY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Karagany (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/karagany"
        date = "2026-10-16"
    strings:
        $fam_name = "karagany" ascii wide nocase
        $alias_1 = "backdoor.karagany" ascii wide nocase
        $alias_2 = "trojan.karagany" ascii wide nocase
        $alias_3 = "apt.dragonfly" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KARAGANY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Karagany tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/karagany"
        date = "2026-10-16"
    strings:
        $attrib_str = "karagany" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Karamanak (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/karamanak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KARAMANAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Karamanak (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/karamanak"
        date = "2026-10-16"
    strings:
        $fam_name = "karamanak" ascii wide nocase
        $alias_1 = "backdoor.carbanak" ascii wide nocase
        $alias_2 = "trojan.karamanak" ascii wide nocase
        $alias_3 = "apt.fin7.carbanak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KARAMANAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Karamanak tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/karamanak"
        date = "2026-10-16"
    strings:
        $attrib_str = "karamanak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Karius (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/karius
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KARIUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Karius (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/karius"
        date = "2026-10-16"
    strings:
        $fam_name = "karius" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KARIUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Karius tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/karius"
        date = "2026-10-16"
    strings:
        $attrib_str = "karius" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kaseya (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kaseya
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KASEYA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kaseya (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kaseya"
        date = "2026-10-16"
    strings:
        $fam_name = "kaseya" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KASEYA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kaseya tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kaseya"
        date = "2026-10-16"
    strings:
        $attrib_str = "kaseya" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kasidet (Pos_Malware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kasidet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KASIDET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kasidet (Pos_Malware)"
        category = "Pos_Malware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kasidet"
        date = "2026-10-16"
    strings:
        $fam_name = "kasidet" ascii wide nocase
        $alias_1 = "neutrino bot" ascii wide nocase
        $alias_2 = "win32/kasidet" ascii wide nocase
        $alias_3 = "trojan.kasidet" ascii wide nocase
        $alias_4 = "backdoor:win32/kasidet" ascii wide nocase
        $alias_5 = "neutrinopos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KASIDET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kasidet tradecraft"
        category = "Pos_Malware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kasidet"
        date = "2026-10-16"
    strings:
        $attrib_str = "kasidet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kasinst (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kasinst
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KASINST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kasinst (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kasinst"
        date = "2026-10-16"
    strings:
        $fam_name = "kasinst" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KASINST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kasinst tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kasinst"
        date = "2026-10-16"
    strings:
        $attrib_str = "kasinst" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kastenl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kastenl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KASTENL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kastenl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kastenl"
        date = "2026-10-16"
    strings:
        $fam_name = "kastenl" ascii wide nocase
        $alias_1 = "trojan.kastenl" ascii wide nocase
        $alias_2 = "downloader.kastenl" ascii wide nocase
        $alias_3 = "win32/kastenl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KASTENL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kastenl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kastenl"
        date = "2026-10-16"
    strings:
        $attrib_str = "kastenl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kate (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kate (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kate"
        date = "2026-10-16"
    strings:
        $fam_name = "kate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kate tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kate"
        date = "2026-10-16"
    strings:
        $attrib_str = "kate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kates (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kates
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KATES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kates (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kates"
        date = "2026-10-16"
    strings:
        $fam_name = "kates" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KATES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kates tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kates"
        date = "2026-10-16"
    strings:
        $attrib_str = "kates" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Kavos (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kavos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KAVOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kavos (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kavos"
        date = "2026-10-16"
    strings:
        $fam_name = "kavos" ascii wide nocase
        $alias_1 = "trojan.kavos" ascii wide nocase
        $alias_2 = "downloader.kavos" ascii wide nocase
        $alias_3 = "win32/kavos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KAVOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kavos tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kavos"
        date = "2026-10-16"
    strings:
        $attrib_str = "kavos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kaymundler (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kaymundler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KAYMUNDLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kaymundler (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kaymundler"
        date = "2026-10-16"
    strings:
        $fam_name = "kaymundler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KAYMUNDLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kaymundler tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kaymundler"
        date = "2026-10-16"
    strings:
        $attrib_str = "kaymundler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kazus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kazus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KAZUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kazus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kazus"
        date = "2026-10-16"
    strings:
        $fam_name = "kazus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KAZUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kazus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kazus"
        date = "2026-10-16"
    strings:
        $attrib_str = "kazus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kbot"
        date = "2026-10-16"
    strings:
        $fam_name = "kbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "kbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Keenm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/keenm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KEENM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Keenm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keenm"
        date = "2026-10-16"
    strings:
        $fam_name = "keenm" ascii wide nocase
        $alias_1 = "trojan.keenm" ascii wide nocase
        $alias_2 = "downloader.keenm" ascii wide nocase
        $alias_3 = "win32/keenm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KEENM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Keenm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keenm"
        date = "2026-10-16"
    strings:
        $attrib_str = "keenm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kelihos (Spam_Bot)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kelihos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KELIHOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kelihos (Spam_Bot)"
        category = "Spam_Bot"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kelihos"
        date = "2026-10-16"
    strings:
        $fam_name = "kelihos" ascii wide nocase
        $alias_1 = "kelihos" ascii wide nocase
        $alias_2 = "hlux" ascii wide nocase
        $alias_3 = "worm:win32/kelihos" ascii wide nocase
        $alias_4 = "bagle.kelihos" ascii wide nocase
        $alias_5 = "trojan.kelihos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KELIHOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kelihos tradecraft"
        category = "Spam_Bot"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kelihos"
        date = "2026-10-16"
    strings:
        $attrib_str = "kelihos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kelios (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kelios
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KELIOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kelios (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kelios"
        date = "2026-10-16"
    strings:
        $fam_name = "kelios" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KELIOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kelios tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kelios"
        date = "2026-10-16"
    strings:
        $attrib_str = "kelios" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kelvir (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kelvir
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KELVIR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kelvir (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kelvir"
        date = "2026-10-16"
    strings:
        $fam_name = "kelvir" ascii wide nocase
        $alias_1 = "worm.win32.kelvir" ascii wide nocase
        $alias_2 = "im-worm.kelvir" ascii wide nocase
        $alias_3 = "w32/kelvir" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KELVIR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kelvir tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kelvir"
        date = "2026-10-16"
    strings:
        $attrib_str = "kelvir" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Keybase (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/keybase
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KEYBASE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Keybase (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keybase"
        date = "2026-10-16"
    strings:
        $fam_name = "keybase" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KEYBASE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Keybase tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keybase"
        date = "2026-10-16"
    strings:
        $attrib_str = "keybase" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Keyboarddisable (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/keyboarddisable
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KEYBOARDDISABLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Keyboarddisable (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keyboarddisable"
        date = "2026-10-16"
    strings:
        $fam_name = "keyboarddisable" ascii wide nocase
        $alias_1 = "trojan.keyboarddisable" ascii wide nocase
        $alias_2 = "screenlocker component" ascii wide nocase
        $alias_3 = "behavior.keyboardlock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KEYBOARDDISABLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Keyboarddisable tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keyboarddisable"
        date = "2026-10-16"
    strings:
        $attrib_str = "keyboarddisable" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Keyboy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/keyboy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KEYBOY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Keyboy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keyboy"
        date = "2026-10-16"
    strings:
        $fam_name = "keyboy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KEYBOY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Keyboy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keyboy"
        date = "2026-10-16"
    strings:
        $attrib_str = "keyboy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Keydoor (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/keydoor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KEYDOOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Keydoor (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keydoor"
        date = "2026-10-16"
    strings:
        $fam_name = "keydoor" ascii wide nocase
        $alias_1 = "trojan.keydoor" ascii wide nocase
        $alias_2 = "backdoor.keydoor" ascii wide nocase
        $alias_3 = "keylogger.win32.keydoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KEYDOOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Keydoor tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keydoor"
        date = "2026-10-16"
    strings:
        $attrib_str = "keydoor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Keydownload (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/keydownload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KEYDOWNLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Keydownload (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keydownload"
        date = "2026-10-16"
    strings:
        $fam_name = "keydownload" ascii wide nocase
        $alias_1 = "trojan-downloader.keydownload" ascii wide nocase
        $alias_2 = "downloader.keygen" ascii wide nocase
        $alias_3 = "win32/keydownload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KEYDOWNLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Keydownload tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keydownload"
        date = "2026-10-16"
    strings:
        $attrib_str = "keydownload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Keyer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/keyer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KEYER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Keyer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keyer"
        date = "2026-10-16"
    strings:
        $fam_name = "keyer" ascii wide nocase
        $alias_1 = "trojan.keylogger.keyer" ascii wide nocase
        $alias_2 = "spyware.keyer" ascii wide nocase
        $alias_3 = "win32/keyer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KEYER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Keyer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keyer"
        date = "2026-10-16"
    strings:
        $attrib_str = "keyer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Keylogr (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/keylogr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KEYLOGR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Keylogr (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keylogr"
        date = "2026-10-16"
    strings:
        $fam_name = "keylogr" ascii wide nocase
        $alias_1 = "trojan.keylogger" ascii wide nocase
        $alias_2 = "spyware.keylog" ascii wide nocase
        $alias_3 = "riskware.monitor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KEYLOGR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Keylogr tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keylogr"
        date = "2026-10-16"
    strings:
        $attrib_str = "keylogr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Keywordfind (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/keywordfind
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KEYWORDFIND_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Keywordfind (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keywordfind"
        date = "2026-10-16"
    strings:
        $fam_name = "keywordfind" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KEYWORDFIND_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Keywordfind tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/keywordfind"
        date = "2026-10-16"
    strings:
        $attrib_str = "keywordfind" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kgbspy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kgbspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KGBSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kgbspy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kgbspy"
        date = "2026-10-16"
    strings:
        $fam_name = "kgbspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KGBSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kgbspy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kgbspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "kgbspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kgen (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kgen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KGEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kgen (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kgen"
        date = "2026-10-16"
    strings:
        $fam_name = "kgen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KGEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kgen tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kgen"
        date = "2026-10-16"
    strings:
        $attrib_str = "kgen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Khalesi (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/khalesi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KHALESI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Khalesi (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/khalesi"
        date = "2026-10-16"
    strings:
        $fam_name = "khalesi" ascii wide nocase
        $alias_1 = "khalesi" ascii wide nocase
        $alias_2 = "backdoor:win32/khalesi" ascii wide nocase
        $alias_3 = "trojan.khalesi" ascii wide nocase
        $alias_4 = "win32/khalesi" ascii wide nocase
        $alias_5 = "infostealer.khalesi" ascii wide nocase
        $alias_6 = "trojan:win32/khalesi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KHALESI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Khalesi tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/khalesi"
        date = "2026-10-16"
    strings:
        $attrib_str = "khalesi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Kheagol (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kheagol
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KHEAGOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kheagol (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kheagol"
        date = "2026-10-16"
    strings:
        $fam_name = "kheagol" ascii wide nocase
        $alias_1 = "trojan.kheagol" ascii wide nocase
        $alias_2 = "downloader.kheagol" ascii wide nocase
        $alias_3 = "win32/kheagol" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KHEAGOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kheagol tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kheagol"
        date = "2026-10-16"
    strings:
        $attrib_str = "kheagol" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kido (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kido
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KIDO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kido (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kido"
        date = "2026-10-16"
    strings:
        $fam_name = "kido" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KIDO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kido tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kido"
        date = "2026-10-16"
    strings:
        $attrib_str = "kido" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Killall (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/killall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KILLALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Killall (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killall"
        date = "2026-10-16"
    strings:
        $fam_name = "killall" ascii wide nocase
        $alias_1 = "hacktool.killall" ascii wide nocase
        $alias_2 = "trojan.killav" ascii wide nocase
        $alias_3 = "script.wiper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KILLALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Killall tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killall"
        date = "2026-10-16"
    strings:
        $attrib_str = "killall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Killapp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/killapp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KILLAPP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Killapp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killapp"
        date = "2026-10-16"
    strings:
        $fam_name = "killapp" ascii wide nocase
        $alias_1 = "riskware.killapp" ascii wide nocase
        $alias_2 = "tool.killapp" ascii wide nocase
        $alias_3 = "trojan:win32/killapp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KILLAPP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Killapp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killapp"
        date = "2026-10-16"
    strings:
        $attrib_str = "killapp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Killdisk (Wiper)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/killdisk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KILLDISK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Killdisk (Wiper)"
        category = "Wiper"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killdisk"
        date = "2026-10-16"
    strings:
        $fam_name = "killdisk" ascii wide nocase
        $alias_1 = "killdisk" ascii wide nocase
        $alias_2 = "wiper.killdisk" ascii wide nocase
        $alias_3 = "trojan.killdisk" ascii wide nocase
        $alias_4 = "sandworm wiper" ascii wide nocase
        $alias_5 = "win32/killdisk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KILLDISK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Killdisk tradecraft"
        category = "Wiper"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killdisk"
        date = "2026-10-16"
    strings:
        $attrib_str = "killdisk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Killmbr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/killmbr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KILLMBR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Killmbr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killmbr"
        date = "2026-10-16"
    strings:
        $fam_name = "killmbr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KILLMBR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Killmbr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killmbr"
        date = "2026-10-16"
    strings:
        $attrib_str = "killmbr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Killnotes (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/killnotes
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KILLNOTES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Killnotes (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killnotes"
        date = "2026-10-16"
    strings:
        $fam_name = "killnotes" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KILLNOTES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Killnotes tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killnotes"
        date = "2026-10-16"
    strings:
        $attrib_str = "killnotes" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Killproc (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/killproc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KILLPROC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Killproc (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killproc"
        date = "2026-10-16"
    strings:
        $fam_name = "killproc" ascii wide nocase
        $alias_1 = "killproc" ascii wide nocase
        $alias_2 = "trojan:win32/killproc" ascii wide nocase
        $alias_3 = "trojan.win32.killproc" ascii wide nocase
        $alias_4 = "win32/killproc" ascii wide nocase
        $alias_5 = "trojan.bat.killproc" ascii wide nocase
        $alias_6 = "killproc trojan" ascii wide nocase
        $alias_7 = "trojan:win32/killproc.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KILLPROC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Killproc tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killproc"
        date = "2026-10-16"
    strings:
        $attrib_str = "killproc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Killwin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/killwin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KILLWIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Killwin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killwin"
        date = "2026-10-16"
    strings:
        $fam_name = "killwin" ascii wide nocase
        $alias_1 = "trojan.killwin" ascii wide nocase
        $alias_2 = "wiper.killwin" ascii wide nocase
        $alias_3 = "trojan.mbrkiller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KILLWIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Killwin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/killwin"
        date = "2026-10-16"
    strings:
        $attrib_str = "killwin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kingsoft (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kingsoft
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KINGSOFT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kingsoft (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kingsoft"
        date = "2026-10-16"
    strings:
        $fam_name = "kingsoft" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KINGSOFT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kingsoft tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kingsoft"
        date = "2026-10-16"
    strings:
        $attrib_str = "kingsoft" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kirts (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kirts
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KIRTS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kirts (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kirts"
        date = "2026-10-16"
    strings:
        $fam_name = "kirts" ascii wide nocase
        $alias_1 = "ransom:win32/kirts" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.kirts" ascii wide nocase
        $alias_3 = "win32/kirts" ascii wide nocase
        $alias_4 = "kirts ransomware" ascii wide nocase
        $alias_5 = "ransom.kirts" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KIRTS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kirts tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kirts"
        date = "2026-10-16"
    strings:
        $attrib_str = "kirts" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kiser (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kiser
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KISER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kiser (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kiser"
        date = "2026-10-16"
    strings:
        $fam_name = "kiser" ascii wide nocase
        $alias_1 = "trojan.kiser" ascii wide nocase
        $alias_2 = "downloader.kiser" ascii wide nocase
        $alias_3 = "win32/kiser" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KISER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kiser tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kiser"
        date = "2026-10-16"
    strings:
        $attrib_str = "kiser" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kjwar5Ju8Ibgb (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kjwar5ju8ibgb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KJWAR5JU8IBGB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kjwar5Ju8Ibgb (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kjwar5ju8ibgb"
        date = "2026-10-16"
    strings:
        $fam_name = "kjwar5ju8ibgb" ascii wide nocase
        $alias_1 = "trojan.generic.kjwar5ju8ibgb" ascii wide nocase
        $alias_2 = "malware.obfuscated.dga" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KJWAR5JU8IBGB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kjwar5Ju8Ibgb tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kjwar5ju8ibgb"
        date = "2026-10-16"
    strings:
        $attrib_str = "kjwar5ju8ibgb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Klez (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/klez
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KLEZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Klez (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/klez"
        date = "2026-10-16"
    strings:
        $fam_name = "klez" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KLEZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Klez tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/klez"
        date = "2026-10-16"
    strings:
        $attrib_str = "klez" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Klone (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/klone
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KLONE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Klone (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/klone"
        date = "2026-10-16"
    strings:
        $fam_name = "klone" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KLONE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Klone tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/klone"
        date = "2026-10-16"
    strings:
        $attrib_str = "klone" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Klozet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/klozet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KLOZET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Klozet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/klozet"
        date = "2026-10-16"
    strings:
        $fam_name = "klozet" ascii wide nocase
        $alias_1 = "trojan.klozet" ascii wide nocase
        $alias_2 = "downloader.klozet" ascii wide nocase
        $alias_3 = "win32/klozet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KLOZET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Klozet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/klozet"
        date = "2026-10-16"
    strings:
        $attrib_str = "klozet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kmsactivator (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kmsactivator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KMSACTIVATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kmsactivator (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kmsactivator"
        date = "2026-10-16"
    strings:
        $fam_name = "kmsactivator" ascii wide nocase
        $alias_1 = "hacktool.autokms" ascii wide nocase
        $alias_2 = "riskware.kmspico" ascii wide nocase
        $alias_3 = "win32/hackkms" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KMSACTIVATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kmsactivator tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kmsactivator"
        date = "2026-10-16"
    strings:
        $attrib_str = "kmsactivator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kmuaaovs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kmuaaovs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KMUAAOVS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kmuaaovs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kmuaaovs"
        date = "2026-10-16"
    strings:
        $fam_name = "kmuaaovs" ascii wide nocase
        $alias_1 = "trojan.generic.kmuaaovs" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KMUAAOVS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kmuaaovs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kmuaaovs"
        date = "2026-10-16"
    strings:
        $attrib_str = "kmuaaovs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Koal (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/koal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Koal (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/koal"
        date = "2026-10-16"
    strings:
        $fam_name = "koal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Koal tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/koal"
        date = "2026-10-16"
    strings:
        $attrib_str = "koal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kolab (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kolab
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOLAB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kolab (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kolab"
        date = "2026-10-16"
    strings:
        $fam_name = "kolab" ascii wide nocase
        $alias_1 = "worm:win32/kolab" ascii wide nocase
        $alias_2 = "net-worm.win32.kolab" ascii wide nocase
        $alias_3 = "worm_kolabc" ascii wide nocase
        $alias_4 = "w32/kolab" ascii wide nocase
        $alias_5 = "trojan.win32.kolab" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOLAB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kolab tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kolab"
        date = "2026-10-16"
    strings:
        $attrib_str = "kolab" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kolabc (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kolabc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOLABC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kolabc (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kolabc"
        date = "2026-10-16"
    strings:
        $fam_name = "kolabc" ascii wide nocase
        $alias_1 = "kolabc" ascii wide nocase
        $alias_2 = "worm:win32/kolabc" ascii wide nocase
        $alias_3 = "trojan.kolabc" ascii wide nocase
        $alias_4 = "worm.win32.kolab" ascii wide nocase
        $alias_5 = "win32/kolabc" ascii wide nocase
        $alias_6 = "kolab worm" ascii wide nocase
        $alias_7 = "worm:win32/kolab" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOLABC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kolabc tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kolabc"
        date = "2026-10-16"
    strings:
        $attrib_str = "kolabc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kolovorot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kolovorot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOLOVOROT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kolovorot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kolovorot"
        date = "2026-10-16"
    strings:
        $fam_name = "kolovorot" ascii wide nocase
        $alias_1 = "ransom:win32/kolovorot" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.kolovorot" ascii wide nocase
        $alias_3 = "win32/kolovorot" ascii wide nocase
        $alias_4 = "ransom.kolovorot" ascii wide nocase
        $alias_5 = "kolovorot mbr locker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOLOVOROT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kolovorot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kolovorot"
        date = "2026-10-16"
    strings:
        $attrib_str = "kolovorot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Komilet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/komilet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOMILET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Komilet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/komilet"
        date = "2026-10-16"
    strings:
        $fam_name = "komilet" ascii wide nocase
        $alias_1 = "trojan.komilet" ascii wide nocase
        $alias_2 = "downloader.komilet" ascii wide nocase
        $alias_3 = "win32/komilet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOMILET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Komilet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/komilet"
        date = "2026-10-16"
    strings:
        $attrib_str = "komilet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Komodia (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/komodia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOMODIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Komodia (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/komodia"
        date = "2026-10-16"
    strings:
        $fam_name = "komodia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOMODIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Komodia tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/komodia"
        date = "2026-10-16"
    strings:
        $attrib_str = "komodia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Konni (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/konni
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KONNI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Konni (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/konni"
        date = "2026-10-16"
    strings:
        $fam_name = "konni" ascii wide nocase
        $alias_1 = "rat.konni" ascii wide nocase
        $alias_2 = "apt.konni" ascii wide nocase
        $alias_3 = "trojan.win32.konni" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KONNI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Konni tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/konni"
        date = "2026-10-16"
    strings:
        $attrib_str = "konni" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Konus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/konus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KONUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Konus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/konus"
        date = "2026-10-16"
    strings:
        $fam_name = "konus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KONUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Konus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/konus"
        date = "2026-10-16"
    strings:
        $attrib_str = "konus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Koobcafe (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/koobcafe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOOBCAFE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Koobcafe (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/koobcafe"
        date = "2026-10-16"
    strings:
        $fam_name = "koobcafe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOOBCAFE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Koobcafe tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/koobcafe"
        date = "2026-10-16"
    strings:
        $attrib_str = "koobcafe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Koobface (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/koobface
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOOBFACE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Koobface (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/koobface"
        date = "2026-10-16"
    strings:
        $fam_name = "koobface" ascii wide nocase
        $alias_1 = "koobface botnet" ascii wide nocase
        $alias_2 = "worm:win32/koobface" ascii wide nocase
        $alias_3 = "net-worm.win32.koobface" ascii wide nocase
        $alias_4 = "bagle.koobface" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOOBFACE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Koobface tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/koobface"
        date = "2026-10-16"
    strings:
        $attrib_str = "koobface" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Korad (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/korad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KORAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Korad (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/korad"
        date = "2026-10-16"
    strings:
        $fam_name = "korad" ascii wide nocase
        $alias_1 = "trojan.korad" ascii wide nocase
        $alias_2 = "downloader.korad" ascii wide nocase
        $alias_3 = "win32/korad" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KORAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Korad tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/korad"
        date = "2026-10-16"
    strings:
        $attrib_str = "korad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Korplug (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/korplug
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KORPLUG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Korplug (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/korplug"
        date = "2026-10-16"
    strings:
        $fam_name = "korplug" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KORPLUG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Korplug tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/korplug"
        date = "2026-10-16"
    strings:
        $attrib_str = "korplug" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Koutodoor (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/koutodoor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOUTODOOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Koutodoor (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/koutodoor"
        date = "2026-10-16"
    strings:
        $fam_name = "koutodoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOUTODOOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Koutodoor tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/koutodoor"
        date = "2026-10-16"
    strings:
        $attrib_str = "koutodoor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Kovloer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kovloer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOVLOER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kovloer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kovloer"
        date = "2026-10-16"
    strings:
        $fam_name = "kovloer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOVLOER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kovloer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kovloer"
        date = "2026-10-16"
    strings:
        $attrib_str = "kovloer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kovter (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kovter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KOVTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kovter (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kovter"
        date = "2026-10-16"
    strings:
        $fam_name = "kovter" ascii wide nocase
        $alias_1 = "kovter" ascii wide nocase
        $alias_2 = "trojan.kovter" ascii wide nocase
        $alias_3 = "win32/kovter" ascii wide nocase
        $alias_4 = "kovter clicker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KOVTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kovter tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kovter"
        date = "2026-10-16"
    strings:
        $attrib_str = "kovter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Krachulka (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krachulka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRACHULKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krachulka (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krachulka"
        date = "2026-10-16"
    strings:
        $fam_name = "krachulka" ascii wide nocase
        $alias_1 = "trojan.krachulka" ascii wide nocase
        $alias_2 = "downloader.krachulka" ascii wide nocase
        $alias_3 = "win32/krachulka" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRACHULKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krachulka tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krachulka"
        date = "2026-10-16"
    strings:
        $attrib_str = "krachulka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kraddare (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kraddare
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRADDARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kraddare (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kraddare"
        date = "2026-10-16"
    strings:
        $fam_name = "kraddare" ascii wide nocase
        $alias_1 = "ransom:win32/kraddare" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.kraddare" ascii wide nocase
        $alias_3 = "win32/kraddare" ascii wide nocase
        $alias_4 = "kraddare ransomware" ascii wide nocase
        $alias_5 = "ransom.kraddare" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRADDARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kraddare tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kraddare"
        date = "2026-10-16"
    strings:
        $attrib_str = "kraddare" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kradword (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kradword
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRADWORD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kradword (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kradword"
        date = "2026-10-16"
    strings:
        $fam_name = "kradword" ascii wide nocase
        $alias_1 = "trojan.kradword" ascii wide nocase
        $alias_2 = "keylogger.kradword" ascii wide nocase
        $alias_3 = "win32/spy.kradword" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRADWORD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kradword tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kradword"
        date = "2026-10-16"
    strings:
        $attrib_str = "kradword" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kraken (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kraken
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRAKEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kraken (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kraken"
        date = "2026-10-16"
    strings:
        $fam_name = "kraken" ascii wide nocase
        $alias_1 = "botnet.kraken" ascii wide nocase
        $alias_2 = "trojan.kraken" ascii wide nocase
        $alias_3 = "win32/kraken" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRAKEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kraken tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kraken"
        date = "2026-10-16"
    strings:
        $attrib_str = "kraken" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Krakencryptor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krakencryptor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRAKENCRYPTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krakencryptor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krakencryptor"
        date = "2026-10-16"
    strings:
        $fam_name = "krakencryptor" ascii wide nocase
        $alias_1 = "ransom.kraken" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.kraken" ascii wide nocase
        $alias_3 = "win32/filecoder.kraken" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRAKENCRYPTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krakencryptor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krakencryptor"
        date = "2026-10-16"
    strings:
        $attrib_str = "krakencryptor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Krament (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krament
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRAMENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krament (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krament"
        date = "2026-10-16"
    strings:
        $fam_name = "krament" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRAMENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krament tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krament"
        date = "2026-10-16"
    strings:
        $attrib_str = "krament" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kranet (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kranet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRANET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kranet (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kranet"
        date = "2026-10-16"
    strings:
        $fam_name = "kranet" ascii wide nocase
        $alias_1 = "trojan.kranet" ascii wide nocase
        $alias_2 = "botnet.kranet" ascii wide nocase
        $alias_3 = "win32/kranet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRANET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kranet tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kranet"
        date = "2026-10-16"
    strings:
        $attrib_str = "kranet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Krbanker (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krbanker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRBANKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krbanker (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krbanker"
        date = "2026-10-16"
    strings:
        $fam_name = "krbanker" ascii wide nocase
        $alias_1 = "trojan:win32/krbanker" ascii wide nocase
        $alias_2 = "trojan:win32/krbanker.a" ascii wide nocase
        $alias_3 = "trojanspy:win32/krbanker" ascii wide nocase
        $alias_4 = "win32/krbanker" ascii wide nocase
        $alias_5 = "banker.krbanker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRBANKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krbanker tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krbanker"
        date = "2026-10-16"
    strings:
        $attrib_str = "krbanker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Krdr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krdr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRDR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krdr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krdr"
        date = "2026-10-16"
    strings:
        $fam_name = "krdr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRDR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krdr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krdr"
        date = "2026-10-16"
    strings:
        $attrib_str = "krdr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Krepper (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krepper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KREPPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krepper (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krepper"
        date = "2026-10-16"
    strings:
        $fam_name = "krepper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KREPPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krepper tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krepper"
        date = "2026-10-16"
    strings:
        $attrib_str = "krepper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Krilog (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krilog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRILOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krilog (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krilog"
        date = "2026-10-16"
    strings:
        $fam_name = "krilog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRILOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krilog tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krilog"
        date = "2026-10-16"
    strings:
        $attrib_str = "krilog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Kriskynote (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kriskynote
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRISKYNOTE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kriskynote (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kriskynote"
        date = "2026-10-16"
    strings:
        $fam_name = "kriskynote" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRISKYNOTE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kriskynote tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kriskynote"
        date = "2026-10-16"
    strings:
        $attrib_str = "kriskynote" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Krolol (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krolol
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KROLOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krolol (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krolol"
        date = "2026-10-16"
    strings:
        $fam_name = "krolol" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KROLOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krolol tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krolol"
        date = "2026-10-16"
    strings:
        $attrib_str = "krolol" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Krserv (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krserv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRSERV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krserv (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krserv"
        date = "2026-10-16"
    strings:
        $fam_name = "krserv" ascii wide nocase
        $alias_1 = "ransom:win32/krserv" ascii wide nocase
        $alias_2 = "trojan:win32/krserv" ascii wide nocase
        $alias_3 = "win32/krserv" ascii wide nocase
        $alias_4 = "krserv ransomware" ascii wide nocase
        $alias_5 = "krserv service trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRSERV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krserv tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krserv"
        date = "2026-10-16"
    strings:
        $attrib_str = "krserv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Krucky (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krucky
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRUCKY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krucky (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krucky"
        date = "2026-10-16"
    strings:
        $fam_name = "krucky" ascii wide nocase
        $alias_1 = "ransom:win32/krucky" ascii wide nocase
        $alias_2 = "ransom:win32/krucky.a" ascii wide nocase
        $alias_3 = "trojan-ransom.win32.krucky" ascii wide nocase
        $alias_4 = "win32/krucky" ascii wide nocase
        $alias_5 = "ransom.krucky" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRUCKY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krucky tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krucky"
        date = "2026-10-16"
    strings:
        $attrib_str = "krucky" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Krunchy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/krunchy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRUNCHY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Krunchy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krunchy"
        date = "2026-10-16"
    strings:
        $fam_name = "krunchy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRUNCHY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Krunchy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/krunchy"
        date = "2026-10-16"
    strings:
        $attrib_str = "krunchy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kryptpck (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kryptpck
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRYPTPCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kryptpck (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kryptpck"
        date = "2026-10-16"
    strings:
        $fam_name = "kryptpck" ascii wide nocase
        $alias_1 = "ransomware.kryptpck" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.kryptpck" ascii wide nocase
        $alias_3 = "packed.kryptpck" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRYPTPCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kryptpck tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kryptpck"
        date = "2026-10-16"
    strings:
        $attrib_str = "kryptpck" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kryptstarter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kryptstarter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRYPTSTARTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kryptstarter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kryptstarter"
        date = "2026-10-16"
    strings:
        $fam_name = "kryptstarter" ascii wide nocase
        $alias_1 = "trojan.kryptik" ascii wide nocase
        $alias_2 = "downloader.kryptstarter" ascii wide nocase
        $alias_3 = "dropper.kryptik" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRYPTSTARTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kryptstarter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kryptstarter"
        date = "2026-10-16"
    strings:
        $attrib_str = "kryptstarter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kryptyk (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kryptyk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KRYPTYK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kryptyk (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kryptyk"
        date = "2026-10-16"
    strings:
        $fam_name = "kryptyk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KRYPTYK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kryptyk tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kryptyk"
        date = "2026-10-16"
    strings:
        $attrib_str = "kryptyk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ksdler (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ksdler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KSDLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ksdler (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ksdler"
        date = "2026-10-16"
    strings:
        $fam_name = "ksdler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KSDLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ksdler tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ksdler"
        date = "2026-10-16"
    strings:
        $attrib_str = "ksdler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kuaiba (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kuaiba
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KUAIBA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kuaiba (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kuaiba"
        date = "2026-10-16"
    strings:
        $fam_name = "kuaiba" ascii wide nocase
        $alias_1 = "adware:win32/kuaiba" ascii wide nocase
        $alias_2 = "pua:win32/kuaiba" ascii wide nocase
        $alias_3 = "program:win32/kuaiba" ascii wide nocase
        $alias_4 = "kuaiba game box" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KUAIBA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kuaiba tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kuaiba"
        date = "2026-10-16"
    strings:
        $attrib_str = "kuaiba" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kuaizip (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kuaizip
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KUAIZIP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kuaizip (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kuaizip"
        date = "2026-10-16"
    strings:
        $fam_name = "kuaizip" ascii wide nocase
        $alias_1 = "pua:win32/kuaizip" ascii wide nocase
        $alias_2 = "adware:win32/kuaizip" ascii wide nocase
        $alias_3 = "pup.optional.kuaizip" ascii wide nocase
        $alias_4 = "win32/kuaizip.adware" ascii wide nocase
        $alias_5 = "kuaiya.archiver" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KUAIZIP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kuaizip tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kuaizip"
        date = "2026-10-16"
    strings:
        $attrib_str = "kuaizip" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kuluoz (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kuluoz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KULUOZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kuluoz (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kuluoz"
        date = "2026-10-16"
    strings:
        $fam_name = "kuluoz" ascii wide nocase
        $alias_1 = "trojan:win32/kuluoz" ascii wide nocase
        $alias_2 = "trojandownloader:win32/kuluoz" ascii wide nocase
        $alias_3 = "trojan:win32/kuluoz.a" ascii wide nocase
        $alias_4 = "trojan:win32/kuluoz.b" ascii wide nocase
        $alias_5 = "worm:win32/asprox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KULUOZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kuluoz tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kuluoz"
        date = "2026-10-16"
    strings:
        $attrib_str = "kuluoz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Kuping (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kuping
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KUPING_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kuping (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kuping"
        date = "2026-10-16"
    strings:
        $fam_name = "kuping" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KUPING_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kuping tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kuping"
        date = "2026-10-16"
    strings:
        $attrib_str = "kuping" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kura (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kura
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KURA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kura (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kura"
        date = "2026-10-16"
    strings:
        $fam_name = "kura" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KURA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kura tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kura"
        date = "2026-10-16"
    strings:
        $attrib_str = "kura" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Kuzitui (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kuzitui
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KUZITUI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kuzitui (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kuzitui"
        date = "2026-10-16"
    strings:
        $fam_name = "kuzitui" ascii wide nocase
        $alias_1 = "adware.kuzitui" ascii wide nocase
        $alias_2 = "pua:win32/kuzitui" ascii wide nocase
        $alias_3 = "adware:win32/kuaizip" ascii wide nocase
        $alias_4 = "pua.kuzitui" ascii wide nocase
        $alias_5 = "win32/kuzitui" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KUZITUI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kuzitui tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kuzitui"
        date = "2026-10-16"
    strings:
        $attrib_str = "kuzitui" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Kwampirs (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kwampirs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KWAMPIRS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kwampirs (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kwampirs"
        date = "2026-10-16"
    strings:
        $fam_name = "kwampirs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KWAMPIRS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kwampirs tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kwampirs"
        date = "2026-10-16"
    strings:
        $attrib_str = "kwampirs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Kykymber (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kykymber
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KYKYMBER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kykymber (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kykymber"
        date = "2026-10-16"
    strings:
        $fam_name = "kykymber" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KYKYMBER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kykymber tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kykymber"
        date = "2026-10-16"
    strings:
        $attrib_str = "kykymber" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Kz4Aamkfbloj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/kz4aamkfbloj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_KZ4AAMKFBLOJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kz4Aamkfbloj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kz4aamkfbloj"
        date = "2026-10-16"
    strings:
        $fam_name = "kz4aamkfbloj" ascii wide nocase
        $alias_1 = "trojan.obfuscated.gen" ascii wide nocase
        $alias_2 = "dropper.randomname" ascii wide nocase
        $alias_3 = "win32/trojan.packer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_KZ4AAMKFBLOJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kz4Aamkfbloj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/kz4aamkfbloj"
        date = "2026-10-16"
    strings:
        $attrib_str = "kz4aamkfbloj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Laban (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/laban
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LABAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Laban (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/laban"
        date = "2026-10-16"
    strings:
        $fam_name = "laban" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LABAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Laban tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/laban"
        date = "2026-10-16"
    strings:
        $attrib_str = "laban" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lamer (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lamer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LAMER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lamer (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lamer"
        date = "2026-10-16"
    strings:
        $fam_name = "lamer" ascii wide nocase
        $alias_1 = "lamer" ascii wide nocase
        $alias_2 = "worm:win32/lamer" ascii wide nocase
        $alias_3 = "w32/lamer" ascii wide nocase
        $alias_4 = "trojan.lamer" ascii wide nocase
        $alias_5 = "worm.win32.lamer" ascii wide nocase
        $alias_6 = "backdoor.lamer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LAMER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lamer tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lamer"
        date = "2026-10-16"
    strings:
        $attrib_str = "lamer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Lanfiltrator (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lanfiltrator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LANFILTRATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lanfiltrator (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lanfiltrator"
        date = "2026-10-16"
    strings:
        $fam_name = "lanfiltrator" ascii wide nocase
        $alias_1 = "trojan:win32/lanfiltrator" ascii wide nocase
        $alias_2 = "spyware.win32.lanfiltrator" ascii wide nocase
        $alias_3 = "trojan.lanfiltrator" ascii wide nocase
        $alias_4 = "win32/lanfiltrator.spyware" ascii wide nocase
        $alias_5 = "lanfiltrator.sniffer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LANFILTRATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lanfiltrator tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lanfiltrator"
        date = "2026-10-16"
    strings:
        $attrib_str = "lanfiltrator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lanxue (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lanxue
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LANXUE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lanxue (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lanxue"
        date = "2026-10-16"
    strings:
        $fam_name = "lanxue" ascii wide nocase
        $alias_1 = "trojan.lanxue" ascii wide nocase
        $alias_2 = "downloader.lanxue" ascii wide nocase
        $alias_3 = "win32/lanxue" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LANXUE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lanxue tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lanxue"
        date = "2026-10-16"
    strings:
        $attrib_str = "lanxue" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lapka (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lapka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LAPKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lapka (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lapka"
        date = "2026-10-16"
    strings:
        $fam_name = "lapka" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LAPKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lapka tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lapka"
        date = "2026-10-16"
    strings:
        $attrib_str = "lapka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Laqma (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/laqma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LAQMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Laqma (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/laqma"
        date = "2026-10-16"
    strings:
        $fam_name = "laqma" ascii wide nocase
        $alias_1 = "trojanspy:win32/laqma.b" ascii wide nocase
        $alias_2 = "virtool:winnt/laqma.c" ascii wide nocase
        $alias_3 = "trojan:win32/laqma" ascii wide nocase
        $alias_4 = "troj/laqma-a" ascii wide nocase
        $alias_5 = "win32/laqma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LAQMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Laqma tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/laqma"
        date = "2026-10-16"
    strings:
        $attrib_str = "laqma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Launcher (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/launcher
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LAUNCHER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Launcher (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/launcher"
        date = "2026-10-16"
    strings:
        $fam_name = "launcher" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LAUNCHER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Launcher tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/launcher"
        date = "2026-10-16"
    strings:
        $attrib_str = "launcher" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lazagne (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lazagne
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LAZAGNE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lazagne (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lazagne"
        date = "2026-10-16"
    strings:
        $fam_name = "lazagne" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LAZAGNE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lazagne tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lazagne"
        date = "2026-10-16"
    strings:
        $attrib_str = "lazagne" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ldpinch (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ldpinch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LDPINCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ldpinch (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ldpinch"
        date = "2026-10-16"
    strings:
        $fam_name = "ldpinch" ascii wide nocase
        $alias_1 = "trojan-psw.win32.ldpinch" ascii wide nocase
        $alias_2 = "pws:win32/ldpinch" ascii wide nocase
        $alias_3 = "trojan.pinch" ascii wide nocase
        $alias_4 = "infostealer.ldpinch" ascii wide nocase
        $alias_5 = "trojan-psw:win32/ldpinch.gen" ascii wide nocase
        $alias_6 = "backdoor.win32.pinch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LDPINCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ldpinch tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ldpinch"
        date = "2026-10-16"
    strings:
        $attrib_str = "ldpinch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lebag (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lebag
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LEBAG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lebag (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lebag"
        date = "2026-10-16"
    strings:
        $fam_name = "lebag" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LEBAG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lebag tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lebag"
        date = "2026-10-16"
    strings:
        $attrib_str = "lebag" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ledruppi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ledruppi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LEDRUPPI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ledruppi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ledruppi"
        date = "2026-10-16"
    strings:
        $fam_name = "ledruppi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LEDRUPPI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ledruppi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ledruppi"
        date = "2026-10-16"
    strings:
        $attrib_str = "ledruppi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Leivion (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/leivion
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LEIVION_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Leivion (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/leivion"
        date = "2026-10-16"
    strings:
        $fam_name = "leivion" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LEIVION_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Leivion tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/leivion"
        date = "2026-10-16"
    strings:
        $attrib_str = "leivion" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lemoore (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lemoore
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LEMOORE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lemoore (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lemoore"
        date = "2026-10-16"
    strings:
        $fam_name = "lemoore" ascii wide nocase
        $alias_1 = "trojan.lemoore" ascii wide nocase
        $alias_2 = "downloader.lemoore" ascii wide nocase
        $alias_3 = "win32/lemoore" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LEMOORE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lemoore tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lemoore"
        date = "2026-10-16"
    strings:
        $attrib_str = "lemoore" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lenwadu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lenwadu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LENWADU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lenwadu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lenwadu"
        date = "2026-10-16"
    strings:
        $fam_name = "lenwadu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LENWADU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lenwadu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lenwadu"
        date = "2026-10-16"
    strings:
        $attrib_str = "lenwadu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Leopard (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/leopard
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LEOPARD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Leopard (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/leopard"
        date = "2026-10-16"
    strings:
        $fam_name = "leopard" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LEOPARD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Leopard tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/leopard"
        date = "2026-10-16"
    strings:
        $attrib_str = "leopard" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lethic (Spam_Bot)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lethic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LETHIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lethic (Spam_Bot)"
        category = "Spam_Bot"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lethic"
        date = "2026-10-16"
    strings:
        $fam_name = "lethic" ascii wide nocase
        $alias_1 = "lethic" ascii wide nocase
        $alias_2 = "spambot.lethic" ascii wide nocase
        $alias_3 = "trojan.lethic" ascii wide nocase
        $alias_4 = "win32/lethic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LETHIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lethic tradecraft"
        category = "Spam_Bot"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lethic"
        date = "2026-10-16"
    strings:
        $attrib_str = "lethic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Leymo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/leymo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LEYMO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Leymo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/leymo"
        date = "2026-10-16"
    strings:
        $fam_name = "leymo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LEYMO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Leymo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/leymo"
        date = "2026-10-16"
    strings:
        $attrib_str = "leymo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Libie (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/libie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIBIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Libie (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/libie"
        date = "2026-10-16"
    strings:
        $fam_name = "libie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIBIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Libie tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/libie"
        date = "2026-10-16"
    strings:
        $attrib_str = "libie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Libsam (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/libsam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIBSAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Libsam (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/libsam"
        date = "2026-10-16"
    strings:
        $fam_name = "libsam" ascii wide nocase
        $alias_1 = "hacktool.libsam" ascii wide nocase
        $alias_2 = "riskware.pwdump.lib" ascii wide nocase
        $alias_3 = "win32/libsam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIBSAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Libsam tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/libsam"
        date = "2026-10-16"
    strings:
        $attrib_str = "libsam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Liev (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/liev
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIEV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Liev (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/liev"
        date = "2026-10-16"
    strings:
        $fam_name = "liev" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIEV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Liev tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/liev"
        date = "2026-10-16"
    strings:
        $attrib_str = "liev" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lightlogger (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lightlogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIGHTLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lightlogger (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lightlogger"
        date = "2026-10-16"
    strings:
        $fam_name = "lightlogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIGHTLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lightlogger tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lightlogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "lightlogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Lightmoon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lightmoon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIGHTMOON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lightmoon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lightmoon"
        date = "2026-10-16"
    strings:
        $fam_name = "lightmoon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIGHTMOON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lightmoon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lightmoon"
        date = "2026-10-16"
    strings:
        $attrib_str = "lightmoon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lightsee (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lightsee
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIGHTSEE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lightsee (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lightsee"
        date = "2026-10-16"
    strings:
        $fam_name = "lightsee" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIGHTSEE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lightsee tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lightsee"
        date = "2026-10-16"
    strings:
        $attrib_str = "lightsee" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Liimpact (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/liimpact
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIIMPACT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Liimpact (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/liimpact"
        date = "2026-10-16"
    strings:
        $fam_name = "liimpact" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIIMPACT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Liimpact tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/liimpact"
        date = "2026-10-16"
    strings:
        $attrib_str = "liimpact" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lineage (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lineage
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LINEAGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lineage (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lineage"
        date = "2026-10-16"
    strings:
        $fam_name = "lineage" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LINEAGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lineage tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lineage"
        date = "2026-10-16"
    strings:
        $attrib_str = "lineage" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Linkhortry (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/linkhortry
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LINKHORTRY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Linkhortry (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/linkhortry"
        date = "2026-10-16"
    strings:
        $fam_name = "linkhortry" ascii wide nocase
        $alias_1 = "trojan.linkhortry" ascii wide nocase
        $alias_2 = "downloader.linkhortry" ascii wide nocase
        $alias_3 = "win32/linkhortry" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LINKHORTRY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Linkhortry tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/linkhortry"
        date = "2026-10-16"
    strings:
        $attrib_str = "linkhortry" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Linkular (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/linkular
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LINKULAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Linkular (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/linkular"
        date = "2026-10-16"
    strings:
        $fam_name = "linkular" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LINKULAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Linkular tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/linkular"
        date = "2026-10-16"
    strings:
        $attrib_str = "linkular" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Linkury (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/linkury
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LINKURY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Linkury (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/linkury"
        date = "2026-10-16"
    strings:
        $fam_name = "linkury" ascii wide nocase
        $alias_1 = "adware:win32/linkury" ascii wide nocase
        $alias_2 = "browsermodifier:win32/linkury" ascii wide nocase
        $alias_3 = "pua:win32/linkury" ascii wide nocase
        $alias_4 = "pup.optional.linkury" ascii wide nocase
        $alias_5 = "adware.smartbar" ascii wide nocase
        $alias_6 = "linkury.smartbar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LINKURY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Linkury tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/linkury"
        date = "2026-10-16"
    strings:
        $attrib_str = "linkury" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Lipler (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lipler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIPLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lipler (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lipler"
        date = "2026-10-16"
    strings:
        $fam_name = "lipler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIPLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lipler tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lipler"
        date = "2026-10-16"
    strings:
        $attrib_str = "lipler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Listicka (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/listicka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LISTICKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Listicka (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/listicka"
        date = "2026-10-16"
    strings:
        $fam_name = "listicka" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LISTICKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Listicka tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/listicka"
        date = "2026-10-16"
    strings:
        $attrib_str = "listicka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Litmus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/litmus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LITMUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Litmus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/litmus"
        date = "2026-10-16"
    strings:
        $fam_name = "litmus" ascii wide nocase
        $alias_1 = "trojan.litmus" ascii wide nocase
        $alias_2 = "downloader.litmus" ascii wide nocase
        $alias_3 = "win32/litmus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LITMUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Litmus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/litmus"
        date = "2026-10-16"
    strings:
        $attrib_str = "litmus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Liudoor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/liudoor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIUDOOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Liudoor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/liudoor"
        date = "2026-10-16"
    strings:
        $fam_name = "liudoor" ascii wide nocase
        $alias_1 = "backdoor.liudoor" ascii wide nocase
        $alias_2 = "trojan.liudoor" ascii wide nocase
        $alias_3 = "win32/liudoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIUDOOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Liudoor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/liudoor"
        date = "2026-10-16"
    strings:
        $attrib_str = "liudoor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Liuliangbao (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/liuliangbao
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIULIANGBAO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Liuliangbao (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/liuliangbao"
        date = "2026-10-16"
    strings:
        $fam_name = "liuliangbao" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIULIANGBAO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Liuliangbao tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/liuliangbao"
        date = "2026-10-16"
    strings:
        $attrib_str = "liuliangbao" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Liusky (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/liusky
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIUSKY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Liusky (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/liusky"
        date = "2026-10-16"
    strings:
        $fam_name = "liusky" ascii wide nocase
        $alias_1 = "trojan.liusky" ascii wide nocase
        $alias_2 = "downloader.liusky" ascii wide nocase
        $alias_3 = "win32/liusky" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIUSKY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Liusky tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/liusky"
        date = "2026-10-16"
    strings:
        $attrib_str = "liusky" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lixeaqbyzsj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lixeaqbyzsj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LIXEAQBYZSJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lixeaqbyzsj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lixeaqbyzsj"
        date = "2026-10-16"
    strings:
        $fam_name = "lixeaqbyzsj" ascii wide nocase
        $alias_1 = "trojan.generic.lixeaqbyzsj" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LIXEAQBYZSJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lixeaqbyzsj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lixeaqbyzsj"
        date = "2026-10-16"
    strings:
        $attrib_str = "lixeaqbyzsj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ljoiner (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ljoiner
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LJOINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ljoiner (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ljoiner"
        date = "2026-10-16"
    strings:
        $fam_name = "ljoiner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LJOINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ljoiner tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ljoiner"
        date = "2026-10-16"
    strings:
        $attrib_str = "ljoiner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Llac (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/llac
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LLAC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Llac (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/llac"
        date = "2026-10-16"
    strings:
        $fam_name = "llac" ascii wide nocase
        $alias_1 = "trojan:win32/llac" ascii wide nocase
        $alias_2 = "trojan.win32.llac" ascii wide nocase
        $alias_3 = "trojan:win32/llac.a" ascii wide nocase
        $alias_4 = "trojan:win32/llac.b" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LLAC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Llac tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/llac"
        date = "2026-10-16"
    strings:
        $attrib_str = "llac" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lmir (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lmir
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LMIR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lmir (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lmir"
        date = "2026-10-16"
    strings:
        $fam_name = "lmir" ascii wide nocase
        $alias_1 = "pws:win32/lmir" ascii wide nocase
        $alias_2 = "trojan-psw.win32.lmir" ascii wide nocase
        $alias_3 = "trojan.win32.lmir" ascii wide nocase
        $alias_4 = "win32/lmir" ascii wide nocase
        $alias_5 = "legend of mir stealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LMIR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lmir tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lmir"
        date = "2026-10-16"
    strings:
        $attrib_str = "lmir" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lmkfrhivlcfba (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lmkfrhivlcfba
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LMKFRHIVLCFBA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lmkfrhivlcfba (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lmkfrhivlcfba"
        date = "2026-10-16"
    strings:
        $fam_name = "lmkfrhivlcfba" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.lmkfrhivlcfba" ascii wide nocase
        $alias_3 = "heur.lmkfrhivlcfba" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LMKFRHIVLCFBA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lmkfrhivlcfba tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lmkfrhivlcfba"
        date = "2026-10-16"
    strings:
        $attrib_str = "lmkfrhivlcfba" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Loader (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/loader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Loader (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loader"
        date = "2026-10-16"
    strings:
        $fam_name = "loader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Loader tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loader"
        date = "2026-10-16"
    strings:
        $attrib_str = "loader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Loadmoney (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/loadmoney
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOADMONEY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Loadmoney (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loadmoney"
        date = "2026-10-16"
    strings:
        $fam_name = "loadmoney" ascii wide nocase
        $alias_1 = "adware:win32/loadmoney" ascii wide nocase
        $alias_2 = "pua:win32/loadmoney" ascii wide nocase
        $alias_3 = "pup.optional.loadmoney" ascii wide nocase
        $alias_4 = "win32/loadmoney.downloader" ascii wide nocase
        $alias_5 = "loadmoney.ppi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOADMONEY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Loadmoney tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loadmoney"
        date = "2026-10-16"
    strings:
        $attrib_str = "loadmoney" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Lockbit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lockbit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOCKBIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lockbit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lockbit"
        date = "2026-10-16"
    strings:
        $fam_name = "lockbit" ascii wide nocase
        $alias_1 = "lockbit 3.0" ascii wide nocase
        $alias_2 = "lockbit black" ascii wide nocase
        $alias_3 = "lockbit 2.0" ascii wide nocase
        $alias_4 = "lockbit red" ascii wide nocase
        $alias_5 = "abcd ransomware" ascii wide nocase
        $alias_6 = "trojan.ransom.lockbit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOCKBIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lockbit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lockbit"
        date = "2026-10-16"
    strings:
        $attrib_str = "lockbit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lockcrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lockcrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOCKCRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lockcrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lockcrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "lockcrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOCKCRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lockcrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lockcrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "lockcrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lockpos (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lockpos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOCKPOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lockpos (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lockpos"
        date = "2026-10-16"
    strings:
        $fam_name = "lockpos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOCKPOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lockpos tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lockpos"
        date = "2026-10-16"
    strings:
        $attrib_str = "lockpos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lockscreen (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lockscreen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOCKSCREEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lockscreen (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lockscreen"
        date = "2026-10-16"
    strings:
        $fam_name = "lockscreen" ascii wide nocase
        $alias_1 = "ransom:win32/lockscreen" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.lockscreen" ascii wide nocase
        $alias_3 = "trojan.lockscreen" ascii wide nocase
        $alias_4 = "win32/lockscreen" ascii wide nocase
        $alias_5 = "ransom:win32/lockscreen.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOCKSCREEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lockscreen tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lockscreen"
        date = "2026-10-16"
    strings:
        $attrib_str = "lockscreen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Locky (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/locky
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOCKY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Locky (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/locky"
        date = "2026-10-16"
    strings:
        $fam_name = "locky" ascii wide nocase
        $alias_1 = "locky" ascii wide nocase
        $alias_2 = "ransom.locky" ascii wide nocase
        $alias_3 = "win32/locky" ascii wide nocase
        $alias_4 = "trojan-ransom.win32.locky" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOCKY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Locky tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/locky"
        date = "2026-10-16"
    strings:
        $attrib_str = "locky" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lockyc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lockyc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOCKYC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lockyc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lockyc"
        date = "2026-10-16"
    strings:
        $fam_name = "lockyc" ascii wide nocase
        $alias_1 = "ransomware.lockyc" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.locky" ascii wide nocase
        $alias_3 = "filecoder.locky" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOCKYC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lockyc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lockyc"
        date = "2026-10-16"
    strings:
        $attrib_str = "lockyc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lodbak (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lodbak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LODBAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lodbak (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lodbak"
        date = "2026-10-16"
    strings:
        $fam_name = "lodbak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LODBAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lodbak tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lodbak"
        date = "2026-10-16"
    strings:
        $attrib_str = "lodbak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Logicielsespions (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/logicielsespions
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOGICIELSESPIONS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Logicielsespions (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/logicielsespions"
        date = "2026-10-16"
    strings:
        $fam_name = "logicielsespions" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOGICIELSESPIONS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Logicielsespions tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/logicielsespions"
        date = "2026-10-16"
    strings:
        $attrib_str = "logicielsespions" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Lojulox (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lojulox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOJULOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lojulox (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lojulox"
        date = "2026-10-16"
    strings:
        $fam_name = "lojulox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOJULOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lojulox tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lojulox"
        date = "2026-10-16"
    strings:
        $attrib_str = "lojulox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Loki (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/loki
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOKI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Loki (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loki"
        date = "2026-10-16"
    strings:
        $fam_name = "loki" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOKI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Loki tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loki"
        date = "2026-10-16"
    strings:
        $attrib_str = "loki" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lokibot (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lokibot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOKIBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lokibot (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lokibot"
        date = "2026-10-16"
    strings:
        $fam_name = "lokibot" ascii wide nocase
        $alias_1 = "lokibot" ascii wide nocase
        $alias_2 = "loki pws" ascii wide nocase
        $alias_3 = "loki-bot" ascii wide nocase
        $alias_4 = "infostealer.lokibot" ascii wide nocase
        $alias_5 = "trojan-psw.win32.loki" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOKIBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lokibot tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lokibot"
        date = "2026-10-16"
    strings:
        $attrib_str = "lokibot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lolbot (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lolbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOLBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lolbot (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lolbot"
        date = "2026-10-16"
    strings:
        $fam_name = "lolbot" ascii wide nocase
        $alias_1 = "lolbot" ascii wide nocase
        $alias_2 = "worm:win32/lolbot" ascii wide nocase
        $alias_3 = "w32/lolbot" ascii wide nocase
        $alias_4 = "trojan.win32.lolbot" ascii wide nocase
        $alias_5 = "worm.win32.lolbot" ascii wide nocase
        $alias_6 = "lolbot.a" ascii wide nocase
        $alias_7 = "lolbot.b" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOLBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lolbot tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lolbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "lolbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Lollipop (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lollipop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOLLIPOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lollipop (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lollipop"
        date = "2026-10-16"
    strings:
        $fam_name = "lollipop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOLLIPOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lollipop tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lollipop"
        date = "2026-10-16"
    strings:
        $attrib_str = "lollipop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Lolojan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lolojan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOLOJAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lolojan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lolojan"
        date = "2026-10-16"
    strings:
        $fam_name = "lolojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOLOJAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lolojan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lolojan"
        date = "2026-10-16"
    strings:
        $attrib_str = "lolojan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Look2Me (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/look2me
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOOK2ME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Look2Me (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/look2me"
        date = "2026-10-16"
    strings:
        $fam_name = "look2me" ascii wide nocase
        $alias_1 = "adware.look2me" ascii wide nocase
        $alias_2 = "spyware.l2m" ascii wide nocase
        $alias_3 = "win32/look2me.rootkit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOOK2ME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Look2Me tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/look2me"
        date = "2026-10-16"
    strings:
        $attrib_str = "look2me" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Loops (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/loops
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOOPS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Loops (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loops"
        date = "2026-10-16"
    strings:
        $fam_name = "loops" ascii wide nocase
        $alias_1 = "trojan.loops" ascii wide nocase
        $alias_2 = "downloader.loops" ascii wide nocase
        $alias_3 = "win32/loops" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOOPS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Loops tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loops"
        date = "2026-10-16"
    strings:
        $attrib_str = "loops" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Loring (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/loring
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LORING_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Loring (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loring"
        date = "2026-10-16"
    strings:
        $fam_name = "loring" ascii wide nocase
        $alias_1 = "trojan.loring" ascii wide nocase
        $alias_2 = "downloader.loring" ascii wide nocase
        $alias_3 = "win32/loring" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LORING_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Loring tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loring"
        date = "2026-10-16"
    strings:
        $attrib_str = "loring" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Losabel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/losabel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOSABEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Losabel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/losabel"
        date = "2026-10-16"
    strings:
        $fam_name = "losabel" ascii wide nocase
        $alias_1 = "trojan.losabel" ascii wide nocase
        $alias_2 = "downloader.losabel" ascii wide nocase
        $alias_3 = "win32/losabel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOSABEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Losabel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/losabel"
        date = "2026-10-16"
    strings:
        $attrib_str = "losabel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Loskad (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/loskad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOSKAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Loskad (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loskad"
        date = "2026-10-16"
    strings:
        $fam_name = "loskad" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOSKAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Loskad tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loskad"
        date = "2026-10-16"
    strings:
        $attrib_str = "loskad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lost_Door (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lost_door
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOST_DOOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lost_Door (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lost_door"
        date = "2026-10-16"
    strings:
        $fam_name = "lost_door" ascii wide nocase
        $alias_1 = "backdoor.lostdoor" ascii wide nocase
        $alias_2 = "trojan.win32.lostdoor" ascii wide nocase
        $alias_3 = "backdoor:win32/lostdoor" ascii wide nocase
        $alias_4 = "win32/lostdoor.rat" ascii wide nocase
        $alias_5 = "lostdoor.e-server" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOST_DOOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lost_Door tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lost_door"
        date = "2026-10-16"
    strings:
        $attrib_str = "lost_door" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Lotoor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lotoor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOTOOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lotoor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lotoor"
        date = "2026-10-16"
    strings:
        $fam_name = "lotoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOTOOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lotoor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lotoor"
        date = "2026-10-16"
    strings:
        $attrib_str = "lotoor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Loveletter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/loveletter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOVELETTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Loveletter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loveletter"
        date = "2026-10-16"
    strings:
        $fam_name = "loveletter" ascii wide nocase
        $alias_1 = "vbs/loveletter" ascii wide nocase
        $alias_2 = "worm.iloveyou" ascii wide nocase
        $alias_3 = "vbs.lovebug" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOVELETTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Loveletter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loveletter"
        date = "2026-10-16"
    strings:
        $attrib_str = "loveletter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lovgate (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lovgate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOVGATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lovgate (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lovgate"
        date = "2026-10-16"
    strings:
        $fam_name = "lovgate" ascii wide nocase
        $alias_1 = "worm:win32/lovgate" ascii wide nocase
        $alias_2 = "email-worm.win32.lovgate" ascii wide nocase
        $alias_3 = "backdoor:win32/lovgate" ascii wide nocase
        $alias_4 = "win32/lovgate" ascii wide nocase
        $alias_5 = "i-worm.lovgate" ascii wide nocase
        $alias_6 = "lovgate worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOVGATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lovgate tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lovgate"
        date = "2026-10-16"
    strings:
        $attrib_str = "lovgate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Lowzones (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lowzones
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOWZONES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lowzones (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lowzones"
        date = "2026-10-16"
    strings:
        $fam_name = "lowzones" ascii wide nocase
        $alias_1 = "trojan.lowzones" ascii wide nocase
        $alias_2 = "downloader.lowzones" ascii wide nocase
        $alias_3 = "win32/lowzones" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOWZONES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lowzones tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lowzones"
        date = "2026-10-16"
    strings:
        $attrib_str = "lowzones" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Loyeetro (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/loyeetro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOYEETRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Loyeetro (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loyeetro"
        date = "2026-10-16"
    strings:
        $fam_name = "loyeetro" ascii wide nocase
        $alias_1 = "trojan.loyeetro" ascii wide nocase
        $alias_2 = "downloader.loyeetro" ascii wide nocase
        $alias_3 = "win32/loyeetro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOYEETRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Loyeetro tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/loyeetro"
        date = "2026-10-16"
    strings:
        $attrib_str = "loyeetro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lozer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lozer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LOZER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lozer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lozer"
        date = "2026-10-16"
    strings:
        $fam_name = "lozer" ascii wide nocase
        $alias_1 = "trojan.lozer" ascii wide nocase
        $alias_2 = "backdoor.lozer" ascii wide nocase
        $alias_3 = "win32/lozer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LOZER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lozer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lozer"
        date = "2026-10-16"
    strings:
        $attrib_str = "lozer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lpt8Mkfbyfsjgnkb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lpt8mkfbyfsjgnkb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LPT8MKFBYFSJGNKB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lpt8Mkfbyfsjgnkb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lpt8mkfbyfsjgnkb"
        date = "2026-10-16"
    strings:
        $fam_name = "lpt8mkfbyfsjgnkb" ascii wide nocase
        $alias_1 = "trojan.obfuscated.gen" ascii wide nocase
        $alias_2 = "dropper.randomname" ascii wide nocase
        $alias_3 = "win32/trojan.packer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LPT8MKFBYFSJGNKB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lpt8Mkfbyfsjgnkb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lpt8mkfbyfsjgnkb"
        date = "2026-10-16"
    strings:
        $attrib_str = "lpt8mkfbyfsjgnkb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lsslogger (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lsslogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LSSLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lsslogger (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lsslogger"
        date = "2026-10-16"
    strings:
        $fam_name = "lsslogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LSSLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lsslogger tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lsslogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "lsslogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lucky (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lucky
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LUCKY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lucky (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lucky"
        date = "2026-10-16"
    strings:
        $fam_name = "lucky" ascii wide nocase
        $alias_1 = "ransomware.lucky" ascii wide nocase
        $alias_2 = "ransom.satan" ascii wide nocase
        $alias_3 = "win32/luckyransom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LUCKY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lucky tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lucky"
        date = "2026-10-16"
    strings:
        $attrib_str = "lucky" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ludbaruma (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ludbaruma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LUDBARUMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ludbaruma (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ludbaruma"
        date = "2026-10-16"
    strings:
        $fam_name = "ludbaruma" ascii wide nocase
        $alias_1 = "worm:win32/ludbaruma.a" ascii wide nocase
        $alias_2 = "worm:win32/ludbaruma!pz" ascii wide nocase
        $alias_3 = "trojandropper:win32/ludbaruma" ascii wide nocase
        $alias_4 = "win32/ludbaruma" ascii wide nocase
        $alias_5 = "ludbaruma.worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LUDBARUMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ludbaruma tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ludbaruma"
        date = "2026-10-16"
    strings:
        $attrib_str = "ludbaruma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Luder (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/luder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LUDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Luder (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/luder"
        date = "2026-10-16"
    strings:
        $fam_name = "luder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LUDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Luder tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/luder"
        date = "2026-10-16"
    strings:
        $attrib_str = "luder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ludicrouz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ludicrouz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LUDICROUZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ludicrouz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ludicrouz"
        date = "2026-10-16"
    strings:
        $fam_name = "ludicrouz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LUDICROUZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ludicrouz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ludicrouz"
        date = "2026-10-16"
    strings:
        $attrib_str = "ludicrouz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Luhn (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/luhn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LUHN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Luhn (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/luhn"
        date = "2026-10-16"
    strings:
        $fam_name = "luhn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LUHN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Luhn tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/luhn"
        date = "2026-10-16"
    strings:
        $attrib_str = "luhn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lulusoftware (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lulusoftware
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LULUSOFTWARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lulusoftware (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lulusoftware"
        date = "2026-10-16"
    strings:
        $fam_name = "lulusoftware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LULUSOFTWARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lulusoftware tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lulusoftware"
        date = "2026-10-16"
    strings:
        $attrib_str = "lulusoftware" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Luminorat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/luminorat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LUMINORAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Luminorat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/luminorat"
        date = "2026-10-16"
    strings:
        $fam_name = "luminorat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LUMINORAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Luminorat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/luminorat"
        date = "2026-10-16"
    strings:
        $attrib_str = "luminorat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Luna (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/luna
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LUNA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Luna (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/luna"
        date = "2026-10-16"
    strings:
        $fam_name = "luna" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LUNA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Luna tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/luna"
        date = "2026-10-16"
    strings:
        $attrib_str = "luna" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lunam (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lunam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LUNAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lunam (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lunam"
        date = "2026-10-16"
    strings:
        $fam_name = "lunam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LUNAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lunam tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lunam"
        date = "2026-10-16"
    strings:
        $attrib_str = "lunam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lurk (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lurk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LURK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lurk (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lurk"
        date = "2026-10-16"
    strings:
        $fam_name = "lurk" ascii wide nocase
        $alias_1 = "trojan.lurk" ascii wide nocase
        $alias_2 = "banker.lurk" ascii wide nocase
        $alias_3 = "win32/lurk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LURK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lurk tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lurk"
        date = "2026-10-16"
    strings:
        $attrib_str = "lurk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lyckriks (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lyckriks
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LYCKRIKS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lyckriks (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lyckriks"
        date = "2026-10-16"
    strings:
        $fam_name = "lyckriks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LYCKRIKS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lyckriks tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lyckriks"
        date = "2026-10-16"
    strings:
        $attrib_str = "lyckriks" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lydra (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lydra
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LYDRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lydra (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lydra"
        date = "2026-10-16"
    strings:
        $fam_name = "lydra" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LYDRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lydra tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lydra"
        date = "2026-10-16"
    strings:
        $attrib_str = "lydra" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lynx (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lynx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LYNX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lynx (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lynx"
        date = "2026-10-16"
    strings:
        $fam_name = "lynx" ascii wide nocase
        $alias_1 = "trojan:win32/lynx" ascii wide nocase
        $alias_2 = "spyware:win32/lynx" ascii wide nocase
        $alias_3 = "trojan.lynx" ascii wide nocase
        $alias_4 = "win32/lynx" ascii wide nocase
        $alias_5 = "infostealer.lynx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LYNX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lynx tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lynx"
        date = "2026-10-16"
    strings:
        $attrib_str = "lynx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lyposit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lyposit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LYPOSIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lyposit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lyposit"
        date = "2026-10-16"
    strings:
        $fam_name = "lyposit" ascii wide nocase
        $alias_1 = "ransom:win32/lyposit" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.lyposit" ascii wide nocase
        $alias_3 = "reveton police locker" ascii wide nocase
        $alias_4 = "trojan.lyposit" ascii wide nocase
        $alias_5 = "win32/lyposit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LYPOSIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lyposit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lyposit"
        date = "2026-10-16"
    strings:
        $attrib_str = "lyposit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Lyrics (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lyrics
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LYRICS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lyrics (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lyrics"
        date = "2026-10-16"
    strings:
        $fam_name = "lyrics" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LYRICS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lyrics tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lyrics"
        date = "2026-10-16"
    strings:
        $attrib_str = "lyrics" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mabezat (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mabezat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MABEZAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mabezat (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mabezat"
        date = "2026-10-16"
    strings:
        $fam_name = "mabezat" ascii wide nocase
        $alias_1 = "worm:win32/mabezat" ascii wide nocase
        $alias_2 = "virus:win32/mabezat.b" ascii wide nocase
        $alias_3 = "virus.win32.mabezat.b" ascii wide nocase
        $alias_4 = "win32/mabezat" ascii wide nocase
        $alias_5 = "w32.mabezat" ascii wide nocase
        $alias_6 = "worm.win32.mabezat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MABEZAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mabezat tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mabezat"
        date = "2026-10-16"
    strings:
        $attrib_str = "mabezat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Machaer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/machaer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MACHAER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Machaer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/machaer"
        date = "2026-10-16"
    strings:
        $fam_name = "machaer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MACHAER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Machaer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/machaer"
        date = "2026-10-16"
    strings:
        $attrib_str = "machaer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Macoute (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/macoute
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MACOUTE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Macoute (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/macoute"
        date = "2026-10-16"
    strings:
        $fam_name = "macoute" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MACOUTE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Macoute tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/macoute"
        date = "2026-10-16"
    strings:
        $attrib_str = "macoute" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Macri (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/macri
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MACRI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Macri (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/macri"
        date = "2026-10-16"
    strings:
        $fam_name = "macri" ascii wide nocase
        $alias_1 = "ransom:win32/macri" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.macri" ascii wide nocase
        $alias_3 = "win32/macri" ascii wide nocase
        $alias_4 = "macri ransomware" ascii wide nocase
        $alias_5 = "ransom.macri" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MACRI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Macri tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/macri"
        date = "2026-10-16"
    strings:
        $attrib_str = "macri" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Macrodrop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/macrodrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MACRODROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Macrodrop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/macrodrop"
        date = "2026-10-16"
    strings:
        $fam_name = "macrodrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MACRODROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Macrodrop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/macrodrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "macrodrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Maener (Cryptominer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/maener
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAENER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Maener (Cryptominer)"
        category = "Cryptominer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/maener"
        date = "2026-10-16"
    strings:
        $fam_name = "maener" ascii wide nocase
        $alias_1 = "trojan:win32/maener" ascii wide nocase
        $alias_2 = "trojan.win32.maener" ascii wide nocase
        $alias_3 = "worm:win32/maener" ascii wide nocase
        $alias_4 = "bindmaener" ascii wide nocase
        $alias_5 = "win32/maener.miner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAENER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Maener tradecraft"
        category = "Cryptominer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/maener"
        date = "2026-10-16"
    strings:
        $attrib_str = "maener" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Maesorn (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/maesorn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAESORN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Maesorn (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/maesorn"
        date = "2026-10-16"
    strings:
        $fam_name = "maesorn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAESORN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Maesorn tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/maesorn"
        date = "2026-10-16"
    strings:
        $attrib_str = "maesorn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Magala (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/magala
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAGALA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Magala (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magala"
        date = "2026-10-16"
    strings:
        $fam_name = "magala" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAGALA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Magala tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magala"
        date = "2026-10-16"
    strings:
        $attrib_str = "magala" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Magania (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/magania
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAGANIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Magania (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magania"
        date = "2026-10-16"
    strings:
        $fam_name = "magania" ascii wide nocase
        $alias_1 = "pws:win32/magania" ascii wide nocase
        $alias_2 = "trojan:win32/magania" ascii wide nocase
        $alias_3 = "trojan-pws.win32.magania" ascii wide nocase
        $alias_4 = "win32/magania" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAGANIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Magania tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magania"
        date = "2026-10-16"
    strings:
        $attrib_str = "magania" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Magic (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/magic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAGIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Magic (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magic"
        date = "2026-10-16"
    strings:
        $fam_name = "magic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAGIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Magic tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magic"
        date = "2026-10-16"
    strings:
        $attrib_str = "magic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Magistrcorr (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/magistrcorr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAGISTRCORR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Magistrcorr (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magistrcorr"
        date = "2026-10-16"
    strings:
        $fam_name = "magistrcorr" ascii wide nocase
        $alias_1 = "virus.win32.magistr" ascii wide nocase
        $alias_2 = "worm.magistr" ascii wide nocase
        $alias_3 = "win32/magistr.corrupt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAGISTRCORR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Magistrcorr tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magistrcorr"
        date = "2026-10-16"
    strings:
        $attrib_str = "magistrcorr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Magnat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/magnat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAGNAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Magnat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magnat"
        date = "2026-10-16"
    strings:
        $fam_name = "magnat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAGNAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Magnat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magnat"
        date = "2026-10-16"
    strings:
        $attrib_str = "magnat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Magni (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/magni
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAGNI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Magni (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magni"
        date = "2026-10-16"
    strings:
        $fam_name = "magni" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAGNI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Magni tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/magni"
        date = "2026-10-16"
    strings:
        $attrib_str = "magni" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mago (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mago
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAGO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mago (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mago"
        date = "2026-10-16"
    strings:
        $fam_name = "mago" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAGO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mago tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mago"
        date = "2026-10-16"
    strings:
        $attrib_str = "mago" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mahato (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mahato
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAHATO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mahato (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mahato"
        date = "2026-10-16"
    strings:
        $fam_name = "mahato" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAHATO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mahato tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mahato"
        date = "2026-10-16"
    strings:
        $attrib_str = "mahato" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mailbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mailbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAILBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mailbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mailbot"
        date = "2026-10-16"
    strings:
        $fam_name = "mailbot" ascii wide nocase
        $alias_1 = "trojan.spammer.mailbot" ascii wide nocase
        $alias_2 = "botnet.mailbot" ascii wide nocase
        $alias_3 = "win32/mailbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAILBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mailbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mailbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "mailbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mailcheck (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mailcheck
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAILCHECK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mailcheck (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mailcheck"
        date = "2026-10-16"
    strings:
        $fam_name = "mailcheck" ascii wide nocase
        $alias_1 = "hacktool.mailchecker" ascii wide nocase
        $alias_2 = "riskware.accountchecker" ascii wide nocase
        $alias_3 = "tool.combochecker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAILCHECK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mailcheck tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mailcheck"
        date = "2026-10-16"
    strings:
        $attrib_str = "mailcheck" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mailpassview (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mailpassview
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAILPASSVIEW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mailpassview (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mailpassview"
        date = "2026-10-16"
    strings:
        $fam_name = "mailpassview" ascii wide nocase
        $alias_1 = "hacktool.mailpassview" ascii wide nocase
        $alias_2 = "riskware.passwordviewer" ascii wide nocase
        $alias_3 = "pws.nirsoft" ascii wide nocase
        $alias_4 = "tool.mailpv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAILPASSVIEW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mailpassview tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mailpassview"
        date = "2026-10-16"
    strings:
        $attrib_str = "mailpassview" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mailru (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mailru
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAILRU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mailru (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mailru"
        date = "2026-10-16"
    strings:
        $fam_name = "mailru" ascii wide nocase
        $alias_1 = "pua:win32/mailru" ascii wide nocase
        $alias_2 = "pua:win32/mailrubar" ascii wide nocase
        $alias_3 = "adware.mailru" ascii wide nocase
        $alias_4 = "win32/mailru" ascii wide nocase
        $alias_5 = "mail.ru toolbar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAILRU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mailru tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mailru"
        date = "2026-10-16"
    strings:
        $attrib_str = "mailru" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mailspy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mailspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAILSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mailspy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mailspy"
        date = "2026-10-16"
    strings:
        $fam_name = "mailspy" ascii wide nocase
        $alias_1 = "spyware.mailspy" ascii wide nocase
        $alias_2 = "riskware.emailmonitor" ascii wide nocase
        $alias_3 = "tool.surveillance" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAILSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mailspy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mailspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "mailspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Malex (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/malex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MALEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Malex (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malex"
        date = "2026-10-16"
    strings:
        $fam_name = "malex" ascii wide nocase
        $alias_1 = "trojan:win32/malex" ascii wide nocase
        $alias_2 = "trojan:win32/malex.gen!a" ascii wide nocase
        $alias_3 = "trojan.malex" ascii wide nocase
        $alias_4 = "win32/malex" ascii wide nocase
        $alias_5 = "trojan:win32/malex.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MALEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Malex tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malex"
        date = "2026-10-16"
    strings:
        $attrib_str = "malex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Malkryp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/malkryp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MALKRYP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Malkryp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malkryp"
        date = "2026-10-16"
    strings:
        $fam_name = "malkryp" ascii wide nocase
        $alias_1 = "trojan.malkryp" ascii wide nocase
        $alias_2 = "downloader.malkryp" ascii wide nocase
        $alias_3 = "win32/malkryp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MALKRYP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Malkryp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malkryp"
        date = "2026-10-16"
    strings:
        $attrib_str = "malkryp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Malmaker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/malmaker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MALMAKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Malmaker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malmaker"
        date = "2026-10-16"
    strings:
        $fam_name = "malmaker" ascii wide nocase
        $alias_1 = "hacktool.malmaker" ascii wide nocase
        $alias_2 = "riskware.malwarebuilder" ascii wide nocase
        $alias_3 = "trojan.builder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MALMAKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Malmaker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malmaker"
        date = "2026-10-16"
    strings:
        $attrib_str = "malmaker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Malushka (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/malushka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MALUSHKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Malushka (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malushka"
        date = "2026-10-16"
    strings:
        $fam_name = "malushka" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MALUSHKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Malushka tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malushka"
        date = "2026-10-16"
    strings:
        $attrib_str = "malushka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Malwar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/malwar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MALWAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Malwar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malwar"
        date = "2026-10-16"
    strings:
        $fam_name = "malwar" ascii wide nocase
        $alias_1 = "trojan.generic.malwar" ascii wide nocase
        $alias_2 = "win32/trojan.heur" ascii wide nocase
        $alias_3 = "malware.generic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MALWAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Malwar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malwar"
        date = "2026-10-16"
    strings:
        $attrib_str = "malwar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Malwarecrypter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/malwarecrypter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MALWARECRYPTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Malwarecrypter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malwarecrypter"
        date = "2026-10-16"
    strings:
        $fam_name = "malwarecrypter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MALWARECRYPTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Malwarecrypter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malwarecrypter"
        date = "2026-10-16"
    strings:
        $attrib_str = "malwarecrypter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Malwares (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/malwares
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MALWARES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Malwares (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malwares"
        date = "2026-10-16"
    strings:
        $fam_name = "malwares" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MALWARES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Malwares tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malwares"
        date = "2026-10-16"
    strings:
        $attrib_str = "malwares" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Malxmr (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/malxmr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MALXMR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Malxmr (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malxmr"
        date = "2026-10-16"
    strings:
        $fam_name = "malxmr" ascii wide nocase
        $alias_1 = "coinminer.malxmr" ascii wide nocase
        $alias_2 = "trojan.malxmr" ascii wide nocase
        $alias_3 = "riskware.bitcoinminer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MALXMR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Malxmr tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/malxmr"
        date = "2026-10-16"
    strings:
        $attrib_str = "malxmr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mamianune (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mamianune
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAMIANUNE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mamianune (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mamianune"
        date = "2026-10-16"
    strings:
        $fam_name = "mamianune" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAMIANUNE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mamianune tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mamianune"
        date = "2026-10-16"
    strings:
        $attrib_str = "mamianune" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Manbat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/manbat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MANBAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Manbat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/manbat"
        date = "2026-10-16"
    strings:
        $fam_name = "manbat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MANBAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Manbat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/manbat"
        date = "2026-10-16"
    strings:
        $attrib_str = "manbat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mansabo (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mansabo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MANSABO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mansabo (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mansabo"
        date = "2026-10-16"
    strings:
        $fam_name = "mansabo" ascii wide nocase
        $alias_1 = "trojan:win32/mansabo" ascii wide nocase
        $alias_2 = "trojan.win32.mansabo" ascii wide nocase
        $alias_3 = "trojan:win32/mansabo!msr" ascii wide nocase
        $alias_4 = "win32/mansabo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MANSABO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mansabo tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mansabo"
        date = "2026-10-16"
    strings:
        $attrib_str = "mansabo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mantana (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mantana
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MANTANA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mantana (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mantana"
        date = "2026-10-16"
    strings:
        $fam_name = "mantana" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MANTANA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mantana tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mantana"
        date = "2026-10-16"
    strings:
        $attrib_str = "mantana" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Manuscrypt (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/manuscrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MANUSCRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Manuscrypt (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/manuscrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "manuscrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MANUSCRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Manuscrypt tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/manuscrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "manuscrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Maplestory (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/maplestory
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAPLESTORY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Maplestory (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/maplestory"
        date = "2026-10-16"
    strings:
        $fam_name = "maplestory" ascii wide nocase
        $alias_1 = "trojan.maplestorycheat" ascii wide nocase
        $alias_2 = "hacktool.maplestory" ascii wide nocase
        $alias_3 = "pws.maplestory" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAPLESTORY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Maplestory tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/maplestory"
        date = "2026-10-16"
    strings:
        $attrib_str = "maplestory" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mapsgory (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mapsgory
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAPSGORY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mapsgory (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mapsgory"
        date = "2026-10-16"
    strings:
        $fam_name = "mapsgory" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAPSGORY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mapsgory tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mapsgory"
        date = "2026-10-16"
    strings:
        $attrib_str = "mapsgory" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mapstosteal (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mapstosteal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAPSTOSTEAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mapstosteal (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mapstosteal"
        date = "2026-10-16"
    strings:
        $fam_name = "mapstosteal" ascii wide nocase
        $alias_1 = "trojan.mapstosteal" ascii wide nocase
        $alias_2 = "spyware.dataexfil" ascii wide nocase
        $alias_3 = "infostealer.targeted" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAPSTOSTEAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mapstosteal tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mapstosteal"
        date = "2026-10-16"
    strings:
        $attrib_str = "mapstosteal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Marketscore (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/marketscore
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MARKETSCORE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Marketscore (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/marketscore"
        date = "2026-10-16"
    strings:
        $fam_name = "marketscore" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MARKETSCORE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Marketscore tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/marketscore"
        date = "2026-10-16"
    strings:
        $attrib_str = "marketscore" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Marocan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/marocan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAROCAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Marocan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/marocan"
        date = "2026-10-16"
    strings:
        $fam_name = "marocan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAROCAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Marocan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/marocan"
        date = "2026-10-16"
    strings:
        $attrib_str = "marocan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Matrix (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/matrix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MATRIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Matrix (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/matrix"
        date = "2026-10-16"
    strings:
        $fam_name = "matrix" ascii wide nocase
        $alias_1 = "ransom:win32/matrix" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.matrix" ascii wide nocase
        $alias_3 = "win32/matrix" ascii wide nocase
        $alias_4 = "ransom.matrix" ascii wide nocase
        $alias_5 = "ransom:win32/matrix.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MATRIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Matrix tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/matrix"
        date = "2026-10-16"
    strings:
        $attrib_str = "matrix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Matsnu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/matsnu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MATSNU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Matsnu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/matsnu"
        date = "2026-10-16"
    strings:
        $fam_name = "matsnu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MATSNU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Matsnu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/matsnu"
        date = "2026-10-16"
    strings:
        $attrib_str = "matsnu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Maxdriver (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/maxdriver
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAXDRIVER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Maxdriver (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/maxdriver"
        date = "2026-10-16"
    strings:
        $fam_name = "maxdriver" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAXDRIVER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Maxdriver tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/maxdriver"
        date = "2026-10-16"
    strings:
        $attrib_str = "maxdriver" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Maxsecure (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/maxsecure
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAXSECURE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Maxsecure (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/maxsecure"
        date = "2026-10-16"
    strings:
        $fam_name = "maxsecure" ascii wide nocase
        $alias_1 = "rogue.maxsecure" ascii wide nocase
        $alias_2 = "scareware.maxsecure" ascii wide nocase
        $alias_3 = "fakeav.maxsecure" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAXSECURE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Maxsecure tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/maxsecure"
        date = "2026-10-16"
    strings:
        $attrib_str = "maxsecure" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mazben (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mazben
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MAZBEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mazben (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mazben"
        date = "2026-10-16"
    strings:
        $fam_name = "mazben" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MAZBEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mazben tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mazben"
        date = "2026-10-16"
    strings:
        $attrib_str = "mazben" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mbrlock (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mbrlock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MBRLOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mbrlock (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mbrlock"
        date = "2026-10-16"
    strings:
        $fam_name = "mbrlock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MBRLOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mbrlock tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mbrlock"
        date = "2026-10-16"
    strings:
        $attrib_str = "mbrlock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mdeclass (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mdeclass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MDECLASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mdeclass (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mdeclass"
        date = "2026-10-16"
    strings:
        $fam_name = "mdeclass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MDECLASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mdeclass tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mdeclass"
        date = "2026-10-16"
    strings:
        $attrib_str = "mdeclass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mdrop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mdrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MDROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mdrop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mdrop"
        date = "2026-10-16"
    strings:
        $fam_name = "mdrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MDROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mdrop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mdrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "mdrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Medfos (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/medfos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEDFOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Medfos (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/medfos"
        date = "2026-10-16"
    strings:
        $fam_name = "medfos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEDFOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Medfos tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/medfos"
        date = "2026-10-16"
    strings:
        $attrib_str = "medfos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mediafinder (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mediafinder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEDIAFINDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mediafinder (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mediafinder"
        date = "2026-10-16"
    strings:
        $fam_name = "mediafinder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEDIAFINDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mediafinder tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mediafinder"
        date = "2026-10-16"
    strings:
        $attrib_str = "mediafinder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mediaget (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mediaget
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEDIAGET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mediaget (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mediaget"
        date = "2026-10-16"
    strings:
        $fam_name = "mediaget" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEDIAGET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mediaget tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mediaget"
        date = "2026-10-16"
    strings:
        $attrib_str = "mediaget" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Medialabs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/medialabs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEDIALABS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Medialabs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/medialabs"
        date = "2026-10-16"
    strings:
        $fam_name = "medialabs" ascii wide nocase
        $alias_1 = "adware.medialabs" ascii wide nocase
        $alias_2 = "pup.medialabs" ascii wide nocase
        $alias_3 = "win32/adware.medialabs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEDIALABS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Medialabs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/medialabs"
        date = "2026-10-16"
    strings:
        $attrib_str = "medialabs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mediamagnet (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mediamagnet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEDIAMAGNET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mediamagnet (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mediamagnet"
        date = "2026-10-16"
    strings:
        $fam_name = "mediamagnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEDIAMAGNET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mediamagnet tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mediamagnet"
        date = "2026-10-16"
    strings:
        $attrib_str = "mediamagnet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mediamine (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mediamine
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEDIAMINE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mediamine (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mediamine"
        date = "2026-10-16"
    strings:
        $fam_name = "mediamine" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEDIAMINE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mediamine tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mediamine"
        date = "2026-10-16"
    strings:
        $attrib_str = "mediamine" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mediana (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mediana
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEDIANA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mediana (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mediana"
        date = "2026-10-16"
    strings:
        $fam_name = "mediana" ascii wide nocase
        $alias_1 = "adware.mediana" ascii wide nocase
        $alias_2 = "pup.mediana" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEDIANA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mediana tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mediana"
        date = "2026-10-16"
    strings:
        $attrib_str = "mediana" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Megasearch (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/megasearch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEGASEARCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Megasearch (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/megasearch"
        date = "2026-10-16"
    strings:
        $fam_name = "megasearch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEGASEARCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Megasearch tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/megasearch"
        date = "2026-10-16"
    strings:
        $attrib_str = "megasearch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Meikehuayi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/meikehuayi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEIKEHUAYI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Meikehuayi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/meikehuayi"
        date = "2026-10-16"
    strings:
        $fam_name = "meikehuayi" ascii wide nocase
        $alias_1 = "adware.meikehuayi" ascii wide nocase
        $alias_2 = "pup.meike" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEIKEHUAYI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Meikehuayi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/meikehuayi"
        date = "2026-10-16"
    strings:
        $attrib_str = "meikehuayi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Meinhudong (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/meinhudong
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEINHUDONG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Meinhudong (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/meinhudong"
        date = "2026-10-16"
    strings:
        $fam_name = "meinhudong" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEINHUDONG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Meinhudong tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/meinhudong"
        date = "2026-10-16"
    strings:
        $attrib_str = "meinhudong" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Meinv (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/meinv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEINV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Meinv (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/meinv"
        date = "2026-10-16"
    strings:
        $fam_name = "meinv" ascii wide nocase
        $alias_1 = "trojan.meinv" ascii wide nocase
        $alias_2 = "downloader.meinv" ascii wide nocase
        $alias_3 = "win32/meinv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEINV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Meinv tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/meinv"
        date = "2026-10-16"
    strings:
        $attrib_str = "meinv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mekotio (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mekotio
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEKOTIO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mekotio (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mekotio"
        date = "2026-10-16"
    strings:
        $fam_name = "mekotio" ascii wide nocase
        $alias_1 = "trojan-banker:win32/mekotio" ascii wide nocase
        $alias_2 = "trojan.win32.mekotio" ascii wide nocase
        $alias_3 = "mekotio banker" ascii wide nocase
        $alias_4 = "win32/mekotio" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEKOTIO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mekotio tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mekotio"
        date = "2026-10-16"
    strings:
        $attrib_str = "mekotio" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Memery (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/memery
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEMERY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Memery (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/memery"
        date = "2026-10-16"
    strings:
        $fam_name = "memery" ascii wide nocase
        $alias_1 = "trojan:win32/memery" ascii wide nocase
        $alias_2 = "backdoor:win32/memery" ascii wide nocase
        $alias_3 = "trojan-spy.win32.memery" ascii wide nocase
        $alias_4 = "win32/memery.trojan" ascii wide nocase
        $alias_5 = "spyware.memery" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEMERY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Memery tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/memery"
        date = "2026-10-16"
    strings:
        $attrib_str = "memery" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Meno (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/meno
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MENO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Meno (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/meno"
        date = "2026-10-16"
    strings:
        $fam_name = "meno" ascii wide nocase
        $alias_1 = "trojan.meno" ascii wide nocase
        $alias_2 = "downloader.meno" ascii wide nocase
        $alias_3 = "win32/meno" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MENO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Meno tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/meno"
        date = "2026-10-16"
    strings:
        $attrib_str = "meno" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mensa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mensa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MENSA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mensa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mensa"
        date = "2026-10-16"
    strings:
        $fam_name = "mensa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MENSA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mensa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mensa"
        date = "2026-10-16"
    strings:
        $attrib_str = "mensa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Menti (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/menti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MENTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Menti (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/menti"
        date = "2026-10-16"
    strings:
        $fam_name = "menti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MENTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Menti tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/menti"
        date = "2026-10-16"
    strings:
        $attrib_str = "menti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mepaow (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mepaow
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEPAOW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mepaow (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mepaow"
        date = "2026-10-16"
    strings:
        $fam_name = "mepaow" ascii wide nocase
        $alias_1 = "trojan:win32/mepaow" ascii wide nocase
        $alias_2 = "worm.win32.mepaow" ascii wide nocase
        $alias_3 = "trojan.mepaow" ascii wide nocase
        $alias_4 = "win32/mepaow" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEPAOW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mepaow tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mepaow"
        date = "2026-10-16"
    strings:
        $attrib_str = "mepaow" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Messengerpass (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/messengerpass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MESSENGERPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Messengerpass (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/messengerpass"
        date = "2026-10-16"
    strings:
        $fam_name = "messengerpass" ascii wide nocase
        $alias_1 = "hacktool.mspass" ascii wide nocase
        $alias_2 = "riskware.passwordviewer" ascii wide nocase
        $alias_3 = "pws.nirsoft" ascii wide nocase
        $alias_4 = "tool.messengerpass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MESSENGERPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Messengerpass tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/messengerpass"
        date = "2026-10-16"
    strings:
        $attrib_str = "messengerpass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Messiah (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/messiah
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MESSIAH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Messiah (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/messiah"
        date = "2026-10-16"
    strings:
        $fam_name = "messiah" ascii wide nocase
        $alias_1 = "trojan:win32/messiah" ascii wide nocase
        $alias_2 = "backdoor.win32.messiah" ascii wide nocase
        $alias_3 = "trojan.messiah" ascii wide nocase
        $alias_4 = "win32/messiah.rat" ascii wide nocase
        $alias_5 = "messiah.server" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MESSIAH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Messiah tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/messiah"
        date = "2026-10-16"
    strings:
        $attrib_str = "messiah" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Metel (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/metel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_METEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Metel (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/metel"
        date = "2026-10-16"
    strings:
        $fam_name = "metel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_METEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Metel tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/metel"
        date = "2026-10-16"
    strings:
        $attrib_str = "metel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Meterpreter (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/meterpreter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_METERPRETER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Meterpreter (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/meterpreter"
        date = "2026-10-16"
    strings:
        $fam_name = "meterpreter" ascii wide nocase
        $alias_1 = "hacktool:win32/meterpreter" ascii wide nocase
        $alias_2 = "trojan:win32/meterpreter" ascii wide nocase
        $alias_3 = "meterpreter" ascii wide nocase
        $alias_4 = "metasploit:meterpreter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_METERPRETER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Meterpreter tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/meterpreter"
        date = "2026-10-16"
    strings:
        $attrib_str = "meterpreter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mewsspy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mewsspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEWSSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mewsspy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mewsspy"
        date = "2026-10-16"
    strings:
        $fam_name = "mewsspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEWSSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mewsspy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mewsspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "mewsspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mezzo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mezzo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MEZZO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mezzo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mezzo"
        date = "2026-10-16"
    strings:
        $fam_name = "mezzo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MEZZO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mezzo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mezzo"
        date = "2026-10-16"
    strings:
        $attrib_str = "mezzo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mi0Ax8Mhb4Ji (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mi0ax8mhb4ji
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MI0AX8MHB4JI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mi0Ax8Mhb4Ji (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mi0ax8mhb4ji"
        date = "2026-10-16"
    strings:
        $fam_name = "mi0ax8mhb4ji" ascii wide nocase
        $alias_1 = "trojan.obfuscated.gen" ascii wide nocase
        $alias_2 = "dropper.randomname" ascii wide nocase
        $alias_3 = "win32/trojan.packer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MI0AX8MHB4JI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mi0Ax8Mhb4Ji tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mi0ax8mhb4ji"
        date = "2026-10-16"
    strings:
        $attrib_str = "mi0ax8mhb4ji" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Miancha (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/miancha
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIANCHA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Miancha (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/miancha"
        date = "2026-10-16"
    strings:
        $fam_name = "miancha" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIANCHA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Miancha tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/miancha"
        date = "2026-10-16"
    strings:
        $attrib_str = "miancha" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Microfake (Scareware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/microfake
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MICROFAKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Microfake (Scareware)"
        category = "Scareware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/microfake"
        date = "2026-10-16"
    strings:
        $fam_name = "microfake" ascii wide nocase
        $alias_1 = "rogue:win32/microfake" ascii wide nocase
        $alias_2 = "trojan:win32/microfake" ascii wide nocase
        $alias_3 = "scareware:win32/microfake" ascii wide nocase
        $alias_4 = "microfake scareware" ascii wide nocase
        $alias_5 = "win32/microfake" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MICROFAKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Microfake tradecraft"
        category = "Scareware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/microfake"
        date = "2026-10-16"
    strings:
        $attrib_str = "microfake" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Microjoin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/microjoin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MICROJOIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Microjoin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/microjoin"
        date = "2026-10-16"
    strings:
        $fam_name = "microjoin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MICROJOIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Microjoin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/microjoin"
        date = "2026-10-16"
    strings:
        $attrib_str = "microjoin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Micronames (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/micronames
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MICRONAMES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Micronames (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/micronames"
        date = "2026-10-16"
    strings:
        $fam_name = "micronames" ascii wide nocase
        $alias_1 = "adware.micronames" ascii wide nocase
        $alias_2 = "pup.micronames" ascii wide nocase
        $alias_3 = "browsermodifier:win32/micronames" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MICRONAMES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Micronames tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/micronames"
        date = "2026-10-16"
    strings:
        $attrib_str = "micronames" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Midia (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/midia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIDIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Midia (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/midia"
        date = "2026-10-16"
    strings:
        $fam_name = "midia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIDIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Midia tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/midia"
        date = "2026-10-16"
    strings:
        $attrib_str = "midia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Midie (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/midie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIDIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Midie (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/midie"
        date = "2026-10-16"
    strings:
        $fam_name = "midie" ascii wide nocase
        $alias_1 = "trojan:win32/midie" ascii wide nocase
        $alias_2 = "trojan.win32.midie" ascii wide nocase
        $alias_3 = "win32/midie" ascii wide nocase
        $alias_4 = "midie.a" ascii wide nocase
        $alias_5 = "backdoor:win32/midie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIDIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Midie tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/midie"
        date = "2026-10-16"
    strings:
        $attrib_str = "midie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mikey (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mikey
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIKEY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mikey (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mikey"
        date = "2026-10-16"
    strings:
        $fam_name = "mikey" ascii wide nocase
        $alias_1 = "pua.win32.mikey.aa" ascii wide nocase
        $alias_2 = "trojan:win32/mikey" ascii wide nocase
        $alias_3 = "pua:win32/mikey!mtb" ascii wide nocase
        $alias_4 = "win32/mikey" ascii wide nocase
        $alias_5 = "adware.mikey" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIKEY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mikey tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mikey"
        date = "2026-10-16"
    strings:
        $attrib_str = "mikey" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Milicry (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/milicry
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MILICRY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Milicry (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/milicry"
        date = "2026-10-16"
    strings:
        $fam_name = "milicry" ascii wide nocase
        $alias_1 = "trojan-ransom.win32.milicry" ascii wide nocase
        $alias_2 = "ransom:win32/milicry" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MILICRY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Milicry tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/milicry"
        date = "2026-10-16"
    strings:
        $attrib_str = "milicry" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mimikatz (Credential_Dumper)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mimikatz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIMIKATZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mimikatz (Credential_Dumper)"
        category = "Credential_Dumper"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mimikatz"
        date = "2026-10-16"
    strings:
        $fam_name = "mimikatz" ascii wide nocase
        $alias_1 = "hacktool:win32/mimikatz" ascii wide nocase
        $alias_2 = "tool:win32/mimikatz" ascii wide nocase
        $alias_3 = "hacktool.mimikatz" ascii wide nocase
        $alias_4 = "win32/mimikatz" ascii wide nocase
        $alias_5 = "mimikatz credential dumper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIMIKATZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mimikatz tradecraft"
        category = "Credential_Dumper"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mimikatz"
        date = "2026-10-16"
    strings:
        $attrib_str = "mimikatz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mimilove (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mimilove
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIMILOVE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mimilove (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mimilove"
        date = "2026-10-16"
    strings:
        $fam_name = "mimilove" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIMILOVE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mimilove tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mimilove"
        date = "2026-10-16"
    strings:
        $attrib_str = "mimilove" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mine (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mine
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MINE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mine (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mine"
        date = "2026-10-16"
    strings:
        $fam_name = "mine" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MINE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mine tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mine"
        date = "2026-10-16"
    strings:
        $attrib_str = "mine" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Minebicoin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/minebicoin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MINEBICOIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Minebicoin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/minebicoin"
        date = "2026-10-16"
    strings:
        $fam_name = "minebicoin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MINEBICOIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Minebicoin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/minebicoin"
        date = "2026-10-16"
    strings:
        $attrib_str = "minebicoin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Minerbat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/minerbat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MINERBAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Minerbat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/minerbat"
        date = "2026-10-16"
    strings:
        $fam_name = "minerbat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MINERBAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Minerbat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/minerbat"
        date = "2026-10-16"
    strings:
        $attrib_str = "minerbat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Minerbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/minerbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MINERBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Minerbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/minerbot"
        date = "2026-10-16"
    strings:
        $fam_name = "minerbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MINERBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Minerbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/minerbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "minerbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Minggy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/minggy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MINGGY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Minggy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/minggy"
        date = "2026-10-16"
    strings:
        $fam_name = "minggy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MINGGY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Minggy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/minggy"
        date = "2026-10-16"
    strings:
        $attrib_str = "minggy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Miniduke (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/miniduke
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MINIDUKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Miniduke (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/miniduke"
        date = "2026-10-16"
    strings:
        $fam_name = "miniduke" ascii wide nocase
        $alias_1 = "backdoor:win32/miniduke" ascii wide nocase
        $alias_2 = "trojan:win32/miniduke" ascii wide nocase
        $alias_3 = "win32/miniduke" ascii wide nocase
        $alias_4 = "apt29 miniduke" ascii wide nocase
        $alias_5 = "cozybear miniduke" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MINIDUKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Miniduke tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/miniduke"
        date = "2026-10-16"
    strings:
        $attrib_str = "miniduke" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Minimal (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/minimal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MINIMAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Minimal (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/minimal"
        date = "2026-10-16"
    strings:
        $fam_name = "minimal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MINIMAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Minimal tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/minimal"
        date = "2026-10-16"
    strings:
        $attrib_str = "minimal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mintluks (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mintluks
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MINTLUKS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mintluks (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mintluks"
        date = "2026-10-16"
    strings:
        $fam_name = "mintluks" ascii wide nocase
        $alias_1 = "pws:msil/mintluks" ascii wide nocase
        $alias_2 = "trojandownloader:win32/mintluks" ascii wide nocase
        $alias_3 = "pws:msil/mintluks.a" ascii wide nocase
        $alias_4 = "pws:msil/mintluks.b" ascii wide nocase
        $alias_5 = "msil/mintluks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MINTLUKS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mintluks tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mintluks"
        date = "2026-10-16"
    strings:
        $attrib_str = "mintluks" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mira (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mira
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mira (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mira"
        date = "2026-10-16"
    strings:
        $fam_name = "mira" ascii wide nocase
        $alias_1 = "mira" ascii wide nocase
        $alias_2 = "trojan:win32/mira" ascii wide nocase
        $alias_3 = "worm:win32/mira" ascii wide nocase
        $alias_4 = "w32/mira" ascii wide nocase
        $alias_5 = "win32/mira" ascii wide nocase
        $alias_6 = "trojan.mira" ascii wide nocase
        $alias_7 = "worm.mira" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mira tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mira"
        date = "2026-10-16"
    strings:
        $attrib_str = "mira" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Miragefox (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/miragefox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIRAGEFOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Miragefox (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/miragefox"
        date = "2026-10-16"
    strings:
        $fam_name = "miragefox" ascii wide nocase
        $alias_1 = "trojan.miragefox" ascii wide nocase
        $alias_2 = "backdoor.miragefox" ascii wide nocase
        $alias_3 = "apt15 tool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIRAGEFOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Miragefox tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/miragefox"
        date = "2026-10-16"
    strings:
        $attrib_str = "miragefox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mirai (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mirai
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIRAI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mirai (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mirai"
        date = "2026-10-16"
    strings:
        $fam_name = "mirai" ascii wide nocase
        $alias_1 = "mirai" ascii wide nocase
        $alias_2 = "linux.mirai" ascii wide nocase
        $alias_3 = "botnet.mirai" ascii wide nocase
        $alias_4 = "worm.mirai" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIRAI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mirai tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mirai"
        date = "2026-10-16"
    strings:
        $attrib_str = "mirai" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mirc (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mirc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIRC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mirc (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mirc"
        date = "2026-10-16"
    strings:
        $fam_name = "mirc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIRC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mirc tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mirc"
        date = "2026-10-16"
    strings:
        $attrib_str = "mirc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mirkov (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mirkov
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIRKOV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mirkov (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mirkov"
        date = "2026-10-16"
    strings:
        $fam_name = "mirkov" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIRKOV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mirkov tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mirkov"
        date = "2026-10-16"
    strings:
        $attrib_str = "mirkov" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Miuref (Click_Fraud)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/miuref
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MIUREF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Miuref (Click_Fraud)"
        category = "Click_Fraud"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/miuref"
        date = "2026-10-16"
    strings:
        $fam_name = "miuref" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MIUREF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Miuref tradecraft"
        category = "Click_Fraud"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/miuref"
        date = "2026-10-16"
    strings:
        $attrib_str = "miuref" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mkar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mkar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MKAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mkar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mkar"
        date = "2026-10-16"
    strings:
        $fam_name = "mkar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MKAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mkar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mkar"
        date = "2026-10-16"
    strings:
        $attrib_str = "mkar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mlwr (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mlwr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MLWR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mlwr (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mlwr"
        date = "2026-10-16"
    strings:
        $fam_name = "mlwr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MLWR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mlwr tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mlwr"
        date = "2026-10-16"
    strings:
        $attrib_str = "mlwr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mmnfbgfpueki (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mmnfbgfpueki
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MMNFBGFPUEKI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mmnfbgfpueki (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mmnfbgfpueki"
        date = "2026-10-16"
    strings:
        $fam_name = "mmnfbgfpueki" ascii wide nocase
        $alias_1 = "trojan.generic.mmnfbgfpueki" ascii wide nocase
        $alias_2 = "malware.obfuscated.dga" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MMNFBGFPUEKI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mmnfbgfpueki tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mmnfbgfpueki"
        date = "2026-10-16"
    strings:
        $attrib_str = "mmnfbgfpueki" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mmorpg (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mmorpg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MMORPG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mmorpg (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mmorpg"
        date = "2026-10-16"
    strings:
        $fam_name = "mmorpg" ascii wide nocase
        $alias_1 = "trojan.pws.mmorpg" ascii wide nocase
        $alias_2 = "spyware.onlinegames" ascii wide nocase
        $alias_3 = "win32/pws.mmorpg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MMORPG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mmorpg tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mmorpg"
        date = "2026-10-16"
    strings:
        $attrib_str = "mmorpg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mmsfrmqm16Ci (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mmsfrmqm16ci
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MMSFRMQM16CI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mmsfrmqm16Ci (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mmsfrmqm16ci"
        date = "2026-10-16"
    strings:
        $fam_name = "mmsfrmqm16ci" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MMSFRMQM16CI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mmsfrmqm16Ci tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mmsfrmqm16ci"
        date = "2026-10-16"
    strings:
        $attrib_str = "mmsfrmqm16ci" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mmxmr (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mmxmr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MMXMR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mmxmr (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mmxmr"
        date = "2026-10-16"
    strings:
        $fam_name = "mmxmr" ascii wide nocase
        $alias_1 = "miner.mmxmr" ascii wide nocase
        $alias_2 = "coinminer.monero" ascii wide nocase
        $alias_3 = "riskware.bitcoinminer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MMXMR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mmxmr tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mmxmr"
        date = "2026-10-16"
    strings:
        $attrib_str = "mmxmr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mobogenie (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mobogenie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOBOGENIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mobogenie (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mobogenie"
        date = "2026-10-16"
    strings:
        $fam_name = "mobogenie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOBOGENIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mobogenie tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mobogenie"
        date = "2026-10-16"
    strings:
        $attrib_str = "mobogenie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Moderate (Generic_Detection)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/moderate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MODERATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Moderate (Generic_Detection)"
        category = "Generic_Detection"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moderate"
        date = "2026-10-16"
    strings:
        $fam_name = "moderate" ascii wide nocase
        $alias_1 = "risk.moderate" ascii wide nocase
        $alias_2 = "generic.moderate" ascii wide nocase
        $alias_3 = "pup.moderate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MODERATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Moderate tradecraft"
        category = "Generic_Detection"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moderate"
        date = "2026-10-16"
    strings:
        $attrib_str = "moderate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mods (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mods
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MODS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mods (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mods"
        date = "2026-10-16"
    strings:
        $fam_name = "mods" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MODS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mods tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mods"
        date = "2026-10-16"
    strings:
        $attrib_str = "mods" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mofin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mofin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOFIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mofin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mofin"
        date = "2026-10-16"
    strings:
        $fam_name = "mofin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOFIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mofin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mofin"
        date = "2026-10-16"
    strings:
        $attrib_str = "mofin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mofksys (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mofksys
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOFKSYS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mofksys (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mofksys"
        date = "2026-10-16"
    strings:
        $fam_name = "mofksys" ascii wide nocase
        $alias_1 = "worm:win32/mofksys" ascii wide nocase
        $alias_2 = "trojan:win32/mofksys" ascii wide nocase
        $alias_3 = "win32/mofksys" ascii wide nocase
        $alias_4 = "mofksys worm" ascii wide nocase
        $alias_5 = "worm.mofksys" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOFKSYS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mofksys tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mofksys"
        date = "2026-10-16"
    strings:
        $attrib_str = "mofksys" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mogoogwi (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mogoogwi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOGOOGWI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mogoogwi (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mogoogwi"
        date = "2026-10-16"
    strings:
        $fam_name = "mogoogwi" ascii wide nocase
        $alias_1 = "worm:win32/mogoogwi" ascii wide nocase
        $alias_2 = "worm:win32/mogoogwi.a" ascii wide nocase
        $alias_3 = "trojan:msil/mogoogwi.a" ascii wide nocase
        $alias_4 = "win32/mogoogwi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOGOOGWI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mogoogwi tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mogoogwi"
        date = "2026-10-16"
    strings:
        $attrib_str = "mogoogwi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mokes (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mokes
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOKES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mokes (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mokes"
        date = "2026-10-16"
    strings:
        $fam_name = "mokes" ascii wide nocase
        $alias_1 = "backdoor:win32/mokes.a" ascii wide nocase
        $alias_2 = "backdoor:win32/mokes" ascii wide nocase
        $alias_3 = "backdoor.osx.mokes" ascii wide nocase
        $alias_4 = "backdoor.linux.mokes" ascii wide nocase
        $alias_5 = "trojan.mokes" ascii wide nocase
        $alias_6 = "win32/mokes" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOKES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mokes tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mokes"
        date = "2026-10-16"
    strings:
        $attrib_str = "mokes" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Mokssteal (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mokssteal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOKSSTEAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mokssteal (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mokssteal"
        date = "2026-10-16"
    strings:
        $fam_name = "mokssteal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOKSSTEAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mokssteal tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mokssteal"
        date = "2026-10-16"
    strings:
        $attrib_str = "mokssteal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Molebox (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/molebox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOLEBOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Molebox (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/molebox"
        date = "2026-10-16"
    strings:
        $fam_name = "molebox" ascii wide nocase
        $alias_1 = "packer.molebox" ascii wide nocase
        $alias_2 = "tool.virtualization" ascii wide nocase
        $alias_3 = "win32/packed.molebox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOLEBOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Molebox tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/molebox"
        date = "2026-10-16"
    strings:
        $attrib_str = "molebox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Moleboxultra (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/moleboxultra
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOLEBOXULTRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Moleboxultra (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moleboxultra"
        date = "2026-10-16"
    strings:
        $fam_name = "moleboxultra" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOLEBOXULTRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Moleboxultra tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moleboxultra"
        date = "2026-10-16"
    strings:
        $attrib_str = "moleboxultra" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Moleboxvs (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/moleboxvs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOLEBOXVS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Moleboxvs (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moleboxvs"
        date = "2026-10-16"
    strings:
        $fam_name = "moleboxvs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOLEBOXVS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Moleboxvs tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moleboxvs"
        date = "2026-10-16"
    strings:
        $attrib_str = "moleboxvs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Moljec (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/moljec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOLJEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Moljec (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moljec"
        date = "2026-10-16"
    strings:
        $fam_name = "moljec" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOLJEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Moljec tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moljec"
        date = "2026-10-16"
    strings:
        $attrib_str = "moljec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Molock (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/molock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOLOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Molock (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/molock"
        date = "2026-10-16"
    strings:
        $fam_name = "molock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOLOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Molock tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/molock"
        date = "2026-10-16"
    strings:
        $attrib_str = "molock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Monder (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/monder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MONDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Monder (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/monder"
        date = "2026-10-16"
    strings:
        $fam_name = "monder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MONDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Monder tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/monder"
        date = "2026-10-16"
    strings:
        $attrib_str = "monder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Moneyinst (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/moneyinst
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MONEYINST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Moneyinst (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moneyinst"
        date = "2026-10-16"
    strings:
        $fam_name = "moneyinst" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MONEYINST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Moneyinst tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moneyinst"
        date = "2026-10-16"
    strings:
        $attrib_str = "moneyinst" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mongolock (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mongolock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MONGOLOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mongolock (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mongolock"
        date = "2026-10-16"
    strings:
        $fam_name = "mongolock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MONGOLOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mongolock tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mongolock"
        date = "2026-10-16"
    strings:
        $attrib_str = "mongolock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Monitoringtool (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/monitoringtool
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MONITORINGTOOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Monitoringtool (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/monitoringtool"
        date = "2026-10-16"
    strings:
        $fam_name = "monitoringtool" ascii wide nocase
        $alias_1 = "riskware.monitoringtool" ascii wide nocase
        $alias_2 = "spyware.keylogger" ascii wide nocase
        $alias_3 = "tool.surveillance" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MONITORINGTOOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Monitoringtool tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/monitoringtool"
        date = "2026-10-16"
    strings:
        $attrib_str = "monitoringtool" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Monitortool (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/monitortool
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MONITORTOOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Monitortool (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/monitortool"
        date = "2026-10-16"
    strings:
        $fam_name = "monitortool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MONITORTOOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Monitortool tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/monitortool"
        date = "2026-10-16"
    strings:
        $attrib_str = "monitortool" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Montague (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/montague
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MONTAGUE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Montague (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/montague"
        date = "2026-10-16"
    strings:
        $fam_name = "montague" ascii wide nocase
        $alias_1 = "trojan.pws.montague" ascii wide nocase
        $alias_2 = "infostealer.montague" ascii wide nocase
        $alias_3 = "win32/montague" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MONTAGUE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Montague tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/montague"
        date = "2026-10-16"
    strings:
        $attrib_str = "montague" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Montp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/montp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MONTP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Montp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/montp"
        date = "2026-10-16"
    strings:
        $fam_name = "montp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MONTP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Montp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/montp"
        date = "2026-10-16"
    strings:
        $attrib_str = "montp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Moonlight (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/moonlight
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOONLIGHT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Moonlight (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moonlight"
        date = "2026-10-16"
    strings:
        $fam_name = "moonlight" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOONLIGHT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Moonlight tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moonlight"
        date = "2026-10-16"
    strings:
        $attrib_str = "moonlight" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Moonpie (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/moonpie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOONPIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Moonpie (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moonpie"
        date = "2026-10-16"
    strings:
        $fam_name = "moonpie" ascii wide nocase
        $alias_1 = "backdoor.moonpie" ascii wide nocase
        $alias_2 = "apt.moonpie" ascii wide nocase
        $alias_3 = "win32/moonpie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOONPIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Moonpie tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/moonpie"
        date = "2026-10-16"
    strings:
        $attrib_str = "moonpie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Morphex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/morphex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MORPHEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Morphex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/morphex"
        date = "2026-10-16"
    strings:
        $fam_name = "morphex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MORPHEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Morphex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/morphex"
        date = "2026-10-16"
    strings:
        $attrib_str = "morphex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Morphine (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/morphine
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MORPHINE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Morphine (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/morphine"
        date = "2026-10-16"
    strings:
        $fam_name = "morphine" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MORPHINE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Morphine tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/morphine"
        date = "2026-10-16"
    strings:
        $attrib_str = "morphine" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Morto (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/morto
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MORTO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Morto (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/morto"
        date = "2026-10-16"
    strings:
        $fam_name = "morto" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MORTO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Morto tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/morto"
        date = "2026-10-16"
    strings:
        $attrib_str = "morto" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mostofate (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mostofate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOSTOFATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mostofate (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mostofate"
        date = "2026-10-16"
    strings:
        $fam_name = "mostofate" ascii wide nocase
        $alias_1 = "adware.mostofate" ascii wide nocase
        $alias_2 = "pup.mostofate" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOSTOFATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mostofate tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mostofate"
        date = "2026-10-16"
    strings:
        $attrib_str = "mostofate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mosu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mosu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOSU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mosu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mosu"
        date = "2026-10-16"
    strings:
        $fam_name = "mosu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOSU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mosu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mosu"
        date = "2026-10-16"
    strings:
        $attrib_str = "mosu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mosucker (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mosucker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOSUCKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mosucker (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mosucker"
        date = "2026-10-16"
    strings:
        $fam_name = "mosucker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOSUCKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mosucker tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mosucker"
        date = "2026-10-16"
    strings:
        $attrib_str = "mosucker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mousedisable (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mousedisable
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOUSEDISABLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mousedisable (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mousedisable"
        date = "2026-10-16"
    strings:
        $fam_name = "mousedisable" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOUSEDISABLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mousedisable tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mousedisable"
        date = "2026-10-16"
    strings:
        $attrib_str = "mousedisable" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mozla (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mozla
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MOZLA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mozla (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mozla"
        date = "2026-10-16"
    strings:
        $fam_name = "mozla" ascii wide nocase
        $alias_1 = "trojan.mozla" ascii wide nocase
        $alias_2 = "win32/mozla" ascii wide nocase
        $alias_3 = "backdoor.mozla" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MOZLA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mozla tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mozla"
        date = "2026-10-16"
    strings:
        $attrib_str = "mozla" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mrdec (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mrdec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MRDEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mrdec (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mrdec"
        date = "2026-10-16"
    strings:
        $fam_name = "mrdec" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MRDEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mrdec tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mrdec"
        date = "2026-10-16"
    strings:
        $attrib_str = "mrdec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mresmon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mresmon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MRESMON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mresmon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mresmon"
        date = "2026-10-16"
    strings:
        $fam_name = "mresmon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MRESMON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mresmon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mresmon"
        date = "2026-10-16"
    strings:
        $attrib_str = "mresmon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Msidrop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/msidrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MSIDROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Msidrop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msidrop"
        date = "2026-10-16"
    strings:
        $fam_name = "msidrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MSIDROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Msidrop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msidrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "msidrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Msilbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/msilbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MSILBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Msilbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msilbot"
        date = "2026-10-16"
    strings:
        $fam_name = "msilbot" ascii wide nocase
        $alias_1 = "trojan.msil" ascii wide nocase
        $alias_2 = "msil.bot" ascii wide nocase
        $alias_3 = "win32/msil.agent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MSILBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Msilbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msilbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "msilbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Msildrop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/msildrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MSILDROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Msildrop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msildrop"
        date = "2026-10-16"
    strings:
        $fam_name = "msildrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MSILDROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Msildrop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msildrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "msildrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Msilinj (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/msilinj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MSILINJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Msilinj (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msilinj"
        date = "2026-10-16"
    strings:
        $fam_name = "msilinj" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MSILINJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Msilinj tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msilinj"
        date = "2026-10-16"
    strings:
        $attrib_str = "msilinj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Msilkrypt (Crypter)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/msilkrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MSILKRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Msilkrypt (Crypter)"
        category = "Crypter"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msilkrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "msilkrypt" ascii wide nocase
        $alias_1 = "virtool:msil/msilkrypt" ascii wide nocase
        $alias_2 = "trojan:msil/krypt" ascii wide nocase
        $alias_3 = "virtool:msil/kryptik" ascii wide nocase
        $alias_4 = "msil/msilkrypt" ascii wide nocase
        $alias_5 = "trojan:msil/msilkrypt.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MSILKRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Msilkrypt tradecraft"
        category = "Crypter"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msilkrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "msilkrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Msilpack (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/msilpack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MSILPACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Msilpack (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msilpack"
        date = "2026-10-16"
    strings:
        $fam_name = "msilpack" ascii wide nocase
        $alias_1 = "trojan.msil.packer" ascii wide nocase
        $alias_2 = "msil/cryptor" ascii wide nocase
        $alias_3 = "win32/msilpack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MSILPACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Msilpack tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msilpack"
        date = "2026-10-16"
    strings:
        $attrib_str = "msilpack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Msilperseus (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/msilperseus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MSILPERSEUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Msilperseus (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msilperseus"
        date = "2026-10-16"
    strings:
        $fam_name = "msilperseus" ascii wide nocase
        $alias_1 = "trojan:msil/perseus!rfn" ascii wide nocase
        $alias_2 = "trojan.msil.perseus" ascii wide nocase
        $alias_3 = "msil/perseus" ascii wide nocase
        $alias_4 = "trojan:msil/perseus.a" ascii wide nocase
        $alias_5 = "win32/perseus.stealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MSILPERSEUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Msilperseus tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msilperseus"
        date = "2026-10-16"
    strings:
        $attrib_str = "msilperseus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Msposer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/msposer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MSPOSER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Msposer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msposer"
        date = "2026-10-16"
    strings:
        $fam_name = "msposer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MSPOSER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Msposer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/msposer"
        date = "2026-10-16"
    strings:
        $attrib_str = "msposer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mucc (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mucc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUCC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mucc (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mucc"
        date = "2026-10-16"
    strings:
        $fam_name = "mucc" ascii wide nocase
        $alias_1 = "adware:win32/mucc" ascii wide nocase
        $alias_2 = "pua:win32/mucc" ascii wide nocase
        $alias_3 = "adware.mucc" ascii wide nocase
        $alias_4 = "win32/mucc" ascii wide nocase
        $alias_5 = "adware:win32/mucc.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUCC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mucc tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mucc"
        date = "2026-10-16"
    strings:
        $attrib_str = "mucc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mudrop (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mudrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUDROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mudrop (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mudrop"
        date = "2026-10-16"
    strings:
        $fam_name = "mudrop" ascii wide nocase
        $alias_1 = "trojan-dropper.win32.mudrop" ascii wide nocase
        $alias_2 = "trojan:win32/mudrop" ascii wide nocase
        $alias_3 = "trojan.mudrop" ascii wide nocase
        $alias_4 = "win32/mudrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUDROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mudrop tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mudrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "mudrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Mufanom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mufanom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUFANOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mufanom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mufanom"
        date = "2026-10-16"
    strings:
        $fam_name = "mufanom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUFANOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mufanom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mufanom"
        date = "2026-10-16"
    strings:
        $attrib_str = "mufanom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Multibanker (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/multibanker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MULTIBANKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multibanker (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multibanker"
        date = "2026-10-16"
    strings:
        $fam_name = "multibanker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MULTIBANKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multibanker tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multibanker"
        date = "2026-10-16"
    strings:
        $attrib_str = "multibanker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Multibar (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/multibar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MULTIBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multibar (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multibar"
        date = "2026-10-16"
    strings:
        $fam_name = "multibar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MULTIBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multibar tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multibar"
        date = "2026-10-16"
    strings:
        $attrib_str = "multibar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Multidl (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/multidl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MULTIDL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multidl (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multidl"
        date = "2026-10-16"
    strings:
        $fam_name = "multidl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MULTIDL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multidl tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multidl"
        date = "2026-10-16"
    strings:
        $attrib_str = "multidl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Multidropper (Trojan_Dropper)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/multidropper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MULTIDROPPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multidropper (Trojan_Dropper)"
        category = "Trojan_Dropper"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multidropper"
        date = "2026-10-16"
    strings:
        $fam_name = "multidropper" ascii wide nocase
        $alias_1 = "trojandropper:win32/multidropper" ascii wide nocase
        $alias_2 = "dropper.win32.multi" ascii wide nocase
        $alias_3 = "win32/multidropper" ascii wide nocase
        $alias_4 = "multidropper framework" ascii wide nocase
        $alias_5 = "trojan.multidropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MULTIDROPPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multidropper tradecraft"
        category = "Trojan_Dropper"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multidropper"
        date = "2026-10-16"
    strings:
        $attrib_str = "multidropper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Multiinjector (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/multiinjector
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MULTIINJECTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multiinjector (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multiinjector"
        date = "2026-10-16"
    strings:
        $fam_name = "multiinjector" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MULTIINJECTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multiinjector tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multiinjector"
        date = "2026-10-16"
    strings:
        $attrib_str = "multiinjector" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Multijoiner (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/multijoiner
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MULTIJOINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multijoiner (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multijoiner"
        date = "2026-10-16"
    strings:
        $fam_name = "multijoiner" ascii wide nocase
        $alias_1 = "hacktool.multijoiner" ascii wide nocase
        $alias_2 = "binder.multijoiner" ascii wide nocase
        $alias_3 = "win32/joiner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MULTIJOINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multijoiner tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multijoiner"
        date = "2026-10-16"
    strings:
        $attrib_str = "multijoiner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Multim (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/multim
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MULTIM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multim (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multim"
        date = "2026-10-16"
    strings:
        $fam_name = "multim" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MULTIM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multim tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multim"
        date = "2026-10-16"
    strings:
        $attrib_str = "multim" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Multiminer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/multiminer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MULTIMINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multiminer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multiminer"
        date = "2026-10-16"
    strings:
        $fam_name = "multiminer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MULTIMINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multiminer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multiminer"
        date = "2026-10-16"
    strings:
        $attrib_str = "multiminer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Multipacked (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/multipacked
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MULTIPACKED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multipacked (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multipacked"
        date = "2026-10-16"
    strings:
        $fam_name = "multipacked" ascii wide nocase
        $alias_1 = "virtool:win32/multipacked" ascii wide nocase
        $alias_2 = "packer:win32/multipacked" ascii wide nocase
        $alias_3 = "trojan.win32.multipacked" ascii wide nocase
        $alias_4 = "win32/multipacked" ascii wide nocase
        $alias_5 = "multipacked.gen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MULTIPACKED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multipacked tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multipacked"
        date = "2026-10-16"
    strings:
        $attrib_str = "multipacked" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Multiplug (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/multiplug
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MULTIPLUG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Multiplug (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multiplug"
        date = "2026-10-16"
    strings:
        $fam_name = "multiplug" ascii wide nocase
        $alias_1 = "adware:win32/multiplug" ascii wide nocase
        $alias_2 = "pua:win32/multiplug" ascii wide nocase
        $alias_3 = "program:win32/multiplug" ascii wide nocase
        $alias_4 = "multiplug adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MULTIPLUG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Multiplug tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/multiplug"
        date = "2026-10-16"
    strings:
        $attrib_str = "multiplug" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Muma (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/muma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Muma (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/muma"
        date = "2026-10-16"
    strings:
        $fam_name = "muma" ascii wide nocase
        $alias_1 = "trojan.muma" ascii wide nocase
        $alias_2 = "downloader.muma" ascii wide nocase
        $alias_3 = "win32/muma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Muma tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/muma"
        date = "2026-10-16"
    strings:
        $attrib_str = "muma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mumawow (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mumawow
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUMAWOW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mumawow (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mumawow"
        date = "2026-10-16"
    strings:
        $fam_name = "mumawow" ascii wide nocase
        $alias_1 = "pws.mumawow" ascii wide nocase
        $alias_2 = "trojanspy.wowstealer" ascii wide nocase
        $alias_3 = "win32/muma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUMAWOW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mumawow tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mumawow"
        date = "2026-10-16"
    strings:
        $attrib_str = "mumawow" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mupx (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mupx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUPX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mupx (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mupx"
        date = "2026-10-16"
    strings:
        $fam_name = "mupx" ascii wide nocase
        $alias_1 = "worm.mupx" ascii wide nocase
        $alias_2 = "trojan.mupx" ascii wide nocase
        $alias_3 = "w32/mupx.worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUPX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mupx tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mupx"
        date = "2026-10-16"
    strings:
        $attrib_str = "mupx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Murka (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/murka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MURKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Murka (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/murka"
        date = "2026-10-16"
    strings:
        $fam_name = "murka" ascii wide nocase
        $alias_1 = "trojan.murka" ascii wide nocase
        $alias_2 = "backdoor.murka" ascii wide nocase
        $alias_3 = "win32/murka" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MURKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Murka tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/murka"
        date = "2026-10-16"
    strings:
        $attrib_str = "murka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Murlo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/murlo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MURLO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Murlo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/murlo"
        date = "2026-10-16"
    strings:
        $fam_name = "murlo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MURLO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Murlo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/murlo"
        date = "2026-10-16"
    strings:
        $attrib_str = "murlo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Murofet (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/murofet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUROFET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Murofet (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/murofet"
        date = "2026-10-16"
    strings:
        $fam_name = "murofet" ascii wide nocase
        $alias_1 = "trojan:win32/murofet" ascii wide nocase
        $alias_2 = "trojandownloader:win32/murofet" ascii wide nocase
        $alias_3 = "w32.murofet" ascii wide nocase
        $alias_4 = "trojan-downloader.win32.murofet" ascii wide nocase
        $alias_5 = "win32/murofet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUROFET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Murofet tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/murofet"
        date = "2026-10-16"
    strings:
        $attrib_str = "murofet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Musclecar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/musclecar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUSCLECAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Musclecar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/musclecar"
        date = "2026-10-16"
    strings:
        $fam_name = "musclecar" ascii wide nocase
        $alias_1 = "trojan.musclecar" ascii wide nocase
        $alias_2 = "backdoor.musclecar" ascii wide nocase
        $alias_3 = "win32/musclecar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUSCLECAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Musclecar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/musclecar"
        date = "2026-10-16"
    strings:
        $attrib_str = "musclecar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mutabaha (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mutabaha
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUTABAHA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mutabaha (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mutabaha"
        date = "2026-10-16"
    strings:
        $fam_name = "mutabaha" ascii wide nocase
        $alias_1 = "adware.mutabaha" ascii wide nocase
        $alias_2 = "pup.mutabaha" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUTABAHA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mutabaha tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mutabaha"
        date = "2026-10-16"
    strings:
        $attrib_str = "mutabaha" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mutant (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mutant
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUTANT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mutant (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mutant"
        date = "2026-10-16"
    strings:
        $fam_name = "mutant" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUTANT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mutant tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mutant"
        date = "2026-10-16"
    strings:
        $attrib_str = "mutant" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mutuodo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mutuodo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MUTUODO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mutuodo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mutuodo"
        date = "2026-10-16"
    strings:
        $fam_name = "mutuodo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MUTUODO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mutuodo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mutuodo"
        date = "2026-10-16"
    strings:
        $attrib_str = "mutuodo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mwpm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mwpm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MWPM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mwpm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mwpm"
        date = "2026-10-16"
    strings:
        $fam_name = "mwpm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MWPM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mwpm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mwpm"
        date = "2026-10-16"
    strings:
        $attrib_str = "mwpm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mybeesearch (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mybeesearch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYBEESEARCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mybeesearch (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mybeesearch"
        date = "2026-10-16"
    strings:
        $fam_name = "mybeesearch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYBEESEARCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mybeesearch tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mybeesearch"
        date = "2026-10-16"
    strings:
        $attrib_str = "mybeesearch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mycleanpc (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mycleanpc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYCLEANPC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mycleanpc (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mycleanpc"
        date = "2026-10-16"
    strings:
        $fam_name = "mycleanpc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYCLEANPC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mycleanpc tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mycleanpc"
        date = "2026-10-16"
    strings:
        $attrib_str = "mycleanpc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mycop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mycop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYCOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mycop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mycop"
        date = "2026-10-16"
    strings:
        $fam_name = "mycop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYCOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mycop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mycop"
        date = "2026-10-16"
    strings:
        $attrib_str = "mycop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mydisksu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mydisksu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYDISKSU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mydisksu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mydisksu"
        date = "2026-10-16"
    strings:
        $fam_name = "mydisksu" ascii wide nocase
        $alias_1 = "adware.mydisksu" ascii wide nocase
        $alias_2 = "pup.mydisksu" ascii wide nocase
        $alias_3 = "win32/adware.mydisksu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYDISKSU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mydisksu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mydisksu"
        date = "2026-10-16"
    strings:
        $attrib_str = "mydisksu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mydoom (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mydoom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYDOOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mydoom (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mydoom"
        date = "2026-10-16"
    strings:
        $fam_name = "mydoom" ascii wide nocase
        $alias_1 = "worm:win32/mydoom" ascii wide nocase
        $alias_2 = "w32.mydoom@mm" ascii wide nocase
        $alias_3 = "w32.novarg.a@mm" ascii wide nocase
        $alias_4 = "worm_mimail.r" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYDOOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mydoom tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mydoom"
        date = "2026-10-16"
    strings:
        $attrib_str = "mydoom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Mypcbackup (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mypcbackup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYPCBACKUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mypcbackup (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mypcbackup"
        date = "2026-10-16"
    strings:
        $fam_name = "mypcbackup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYPCBACKUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mypcbackup tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mypcbackup"
        date = "2026-10-16"
    strings:
        $attrib_str = "mypcbackup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Myransom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/myransom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYRANSOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Myransom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/myransom"
        date = "2026-10-16"
    strings:
        $fam_name = "myransom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYRANSOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Myransom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/myransom"
        date = "2026-10-16"
    strings:
        $attrib_str = "myransom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mytob (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mytob
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYTOB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mytob (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mytob"
        date = "2026-10-16"
    strings:
        $fam_name = "mytob" ascii wide nocase
        $alias_1 = "worm.mytob" ascii wide nocase
        $alias_2 = "win32/mytob" ascii wide nocase
        $alias_3 = "email-worm.win32.mytob" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYTOB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mytob tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mytob"
        date = "2026-10-16"
    strings:
        $attrib_str = "mytob" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Mytonel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mytonel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYTONEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mytonel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mytonel"
        date = "2026-10-16"
    strings:
        $fam_name = "mytonel" ascii wide nocase
        $alias_1 = "adware.mytonel" ascii wide nocase
        $alias_2 = "pup.mytonel" ascii wide nocase
        $alias_3 = "win32/adware.mytonel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYTONEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mytonel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mytonel"
        date = "2026-10-16"
    strings:
        $attrib_str = "mytonel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mywebsearch (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mywebsearch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYWEBSEARCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mywebsearch (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mywebsearch"
        date = "2026-10-16"
    strings:
        $fam_name = "mywebsearch" ascii wide nocase
        $alias_1 = "adware:win32/mywebsearch" ascii wide nocase
        $alias_2 = "adware.mywebsearch" ascii wide nocase
        $alias_3 = "mywebsearch toolbar" ascii wide nocase
        $alias_4 = "fun web products toolbar" ascii wide nocase
        $alias_5 = "win32/mywebsearch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYWEBSEARCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mywebsearch tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mywebsearch"
        date = "2026-10-16"
    strings:
        $attrib_str = "mywebsearch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Myxah (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/myxah
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MYXAH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Myxah (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/myxah"
        date = "2026-10-16"
    strings:
        $fam_name = "myxah" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MYXAH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Myxah tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/myxah"
        date = "2026-10-16"
    strings:
        $attrib_str = "myxah" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Mz0A4Gxuisb (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/mz0a4gxuisb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_MZ0A4GXUISB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Mz0A4Gxuisb (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mz0a4gxuisb"
        date = "2026-10-16"
    strings:
        $fam_name = "mz0a4gxuisb" ascii wide nocase
        $alias_1 = "trojan.generic.mz0a4gxuisb" ascii wide nocase
        $alias_2 = "malware.obfuscated.dga" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_MZ0A4GXUISB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Mz0A4Gxuisb tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/mz0a4gxuisb"
        date = "2026-10-16"
    strings:
        $attrib_str = "mz0a4gxuisb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Nabasa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nabasa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NABASA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nabasa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nabasa"
        date = "2026-10-16"
    strings:
        $fam_name = "nabasa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NABASA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nabasa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nabasa"
        date = "2026-10-16"
    strings:
        $attrib_str = "nabasa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Naco (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/naco
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NACO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Naco (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/naco"
        date = "2026-10-16"
    strings:
        $fam_name = "naco" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NACO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Naco tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/naco"
        date = "2026-10-16"
    strings:
        $attrib_str = "naco" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nadrac (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nadrac
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NADRAC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nadrac (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nadrac"
        date = "2026-10-16"
    strings:
        $fam_name = "nadrac" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NADRAC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nadrac tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nadrac"
        date = "2026-10-16"
    strings:
        $attrib_str = "nadrac" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Naffy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/naffy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NAFFY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Naffy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/naffy"
        date = "2026-10-16"
    strings:
        $fam_name = "naffy" ascii wide nocase
        $alias_1 = "trojan.naffy" ascii wide nocase
        $alias_2 = "downloader.naffy" ascii wide nocase
        $alias_3 = "win32/naffy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NAFFY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Naffy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/naffy"
        date = "2026-10-16"
    strings:
        $attrib_str = "naffy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nagoot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nagoot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NAGOOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nagoot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nagoot"
        date = "2026-10-16"
    strings:
        $fam_name = "nagoot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NAGOOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nagoot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nagoot"
        date = "2026-10-16"
    strings:
        $attrib_str = "nagoot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nagram (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nagram
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NAGRAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nagram (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nagram"
        date = "2026-10-16"
    strings:
        $fam_name = "nagram" ascii wide nocase
        $alias_1 = "trojan.nagram" ascii wide nocase
        $alias_2 = "downloader.nagram" ascii wide nocase
        $alias_3 = "win32/nagram" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NAGRAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nagram tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nagram"
        date = "2026-10-16"
    strings:
        $attrib_str = "nagram" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nakoctb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nakoctb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NAKOCTB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nakoctb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nakoctb"
        date = "2026-10-16"
    strings:
        $fam_name = "nakoctb" ascii wide nocase
        $alias_1 = "nakoctb" ascii wide nocase
        $alias_2 = "nakoctb" ascii wide nocase
        $alias_3 = "ransom:win32/nakoctb" ascii wide nocase
        $alias_4 = "trojan:win32/nakoctb" ascii wide nocase
        $alias_5 = "trojan-ransom.win32.nakoctb" ascii wide nocase
        $alias_6 = "win32/nakoctb" ascii wide nocase
        $alias_7 = "nakoctb winlocker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NAKOCTB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nakoctb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nakoctb"
        date = "2026-10-16"
    strings:
        $attrib_str = "nakoctb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nanobot (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nanobot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NANOBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nanobot (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nanobot"
        date = "2026-10-16"
    strings:
        $fam_name = "nanobot" ascii wide nocase
        $alias_1 = "nanobot" ascii wide nocase
        $alias_2 = "backdoor:win32/nanobot" ascii wide nocase
        $alias_3 = "trojan.win32.nanobot" ascii wide nocase
        $alias_4 = "win32/nanobot" ascii wide nocase
        $alias_5 = "nanobot loader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NANOBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nanobot tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nanobot"
        date = "2026-10-16"
    strings:
        $attrib_str = "nanobot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Nanocore (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nanocore
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NANOCORE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nanocore (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nanocore"
        date = "2026-10-16"
    strings:
        $fam_name = "nanocore" ascii wide nocase
        $alias_1 = "nanocore" ascii wide nocase
        $alias_2 = "nanocore rat" ascii wide nocase
        $alias_3 = "win32/nanocore" ascii wide nocase
        $alias_4 = "trojan.nanocore" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NANOCORE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nanocore tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nanocore"
        date = "2026-10-16"
    strings:
        $attrib_str = "nanocore" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Napolar (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/napolar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NAPOLAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Napolar (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/napolar"
        date = "2026-10-16"
    strings:
        $fam_name = "napolar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NAPOLAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Napolar tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/napolar"
        date = "2026-10-16"
    strings:
        $attrib_str = "napolar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Naprat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/naprat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NAPRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Naprat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/naprat"
        date = "2026-10-16"
    strings:
        $fam_name = "naprat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NAPRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Naprat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/naprat"
        date = "2026-10-16"
    strings:
        $attrib_str = "naprat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Narcha (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/narcha
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NARCHA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Narcha (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/narcha"
        date = "2026-10-16"
    strings:
        $fam_name = "narcha" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NARCHA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Narcha tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/narcha"
        date = "2026-10-16"
    strings:
        $attrib_str = "narcha" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Navipromo (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/navipromo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NAVIPROMO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Navipromo (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/navipromo"
        date = "2026-10-16"
    strings:
        $fam_name = "navipromo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NAVIPROMO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Navipromo tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/navipromo"
        date = "2026-10-16"
    strings:
        $attrib_str = "navipromo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nbcont (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nbcont
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NBCONT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nbcont (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nbcont"
        date = "2026-10-16"
    strings:
        $fam_name = "nbcont" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NBCONT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nbcont tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nbcont"
        date = "2026-10-16"
    strings:
        $attrib_str = "nbcont" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nebuler (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nebuler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEBULER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nebuler (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nebuler"
        date = "2026-10-16"
    strings:
        $fam_name = "nebuler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEBULER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nebuler tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nebuler"
        date = "2026-10-16"
    strings:
        $attrib_str = "nebuler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Necne (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/necne
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NECNE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Necne (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/necne"
        date = "2026-10-16"
    strings:
        $fam_name = "necne" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NECNE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Necne tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/necne"
        date = "2026-10-16"
    strings:
        $attrib_str = "necne" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Necurs (Spam_Bot)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/necurs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NECURS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Necurs (Spam_Bot)"
        category = "Spam_Bot"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/necurs"
        date = "2026-10-16"
    strings:
        $fam_name = "necurs" ascii wide nocase
        $alias_1 = "necurs" ascii wide nocase
        $alias_2 = "win32/necurs" ascii wide nocase
        $alias_3 = "rootkit.necurs" ascii wide nocase
        $alias_4 = "trojan.necurs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NECURS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Necurs tradecraft"
        category = "Spam_Bot"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/necurs"
        date = "2026-10-16"
    strings:
        $attrib_str = "necurs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Negasteal (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/negasteal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEGASTEAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Negasteal (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/negasteal"
        date = "2026-10-16"
    strings:
        $fam_name = "negasteal" ascii wide nocase
        $alias_1 = "trojan.negasteal" ascii wide nocase
        $alias_2 = "passwordstealer.nega" ascii wide nocase
        $alias_3 = "win32/negasteal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEGASTEAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Negasteal tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/negasteal"
        date = "2026-10-16"
    strings:
        $attrib_str = "negasteal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Neksminer (Cryptominer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/neksminer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEKSMINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Neksminer (Cryptominer)"
        category = "Cryptominer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neksminer"
        date = "2026-10-16"
    strings:
        $fam_name = "neksminer" ascii wide nocase
        $alias_1 = "trojan:win32/neksminer" ascii wide nocase
        $alias_2 = "coinminer:win32/neksminer" ascii wide nocase
        $alias_3 = "trojan.neksminer" ascii wide nocase
        $alias_4 = "win32/neksminer" ascii wide nocase
        $alias_5 = "coinminer:win32/neksminer.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEKSMINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Neksminer tradecraft"
        category = "Cryptominer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neksminer"
        date = "2026-10-16"
    strings:
        $attrib_str = "neksminer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nemesis (Bootkit)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nemesis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEMESIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nemesis (Bootkit)"
        category = "Bootkit"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nemesis"
        date = "2026-10-16"
    strings:
        $fam_name = "nemesis" ascii wide nocase
        $alias_1 = "bootrash" ascii wide nocase
        $alias_2 = "nemesis bootkit" ascii wide nocase
        $alias_3 = "backdoor:win32/nemesis" ascii wide nocase
        $alias_4 = "trojan.nemesis" ascii wide nocase
        $alias_5 = "fin1 nemesis suite" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEMESIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nemesis tradecraft"
        category = "Bootkit"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nemesis"
        date = "2026-10-16"
    strings:
        $attrib_str = "nemesis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nemucod (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nemucod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEMUCOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nemucod (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nemucod"
        date = "2026-10-16"
    strings:
        $fam_name = "nemucod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEMUCOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nemucod tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nemucod"
        date = "2026-10-16"
    strings:
        $attrib_str = "nemucod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Neobar (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/neobar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEOBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Neobar (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neobar"
        date = "2026-10-16"
    strings:
        $fam_name = "neobar" ascii wide nocase
        $alias_1 = "browsermodifier:win32/neobar" ascii wide nocase
        $alias_2 = "adware:win32/neobar" ascii wide nocase
        $alias_3 = "pua:win32/neobar" ascii wide nocase
        $alias_4 = "toolbar:win32/neobar" ascii wide nocase
        $alias_5 = "win32/neobar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEOBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Neobar tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neobar"
        date = "2026-10-16"
    strings:
        $attrib_str = "neobar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Neoreklami (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/neoreklami
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEOREKLAMI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Neoreklami (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neoreklami"
        date = "2026-10-16"
    strings:
        $fam_name = "neoreklami" ascii wide nocase
        $alias_1 = "adware:win32/neoreklami" ascii wide nocase
        $alias_2 = "adware.neoreklami" ascii wide nocase
        $alias_3 = "program:win32/neoreklami" ascii wide nocase
        $alias_4 = "trojan.win32.neoreklami" ascii wide nocase
        $alias_5 = "pua.neoreklami" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEOREKLAMI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Neoreklami tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neoreklami"
        date = "2026-10-16"
    strings:
        $attrib_str = "neoreklami" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Neos (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/neos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Neos (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neos"
        date = "2026-10-16"
    strings:
        $fam_name = "neos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Neos tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neos"
        date = "2026-10-16"
    strings:
        $attrib_str = "neos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Neshta (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/neshta
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NESHTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Neshta (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neshta"
        date = "2026-10-16"
    strings:
        $fam_name = "neshta" ascii wide nocase
        $alias_1 = "virus:win32/neshta.a" ascii wide nocase
        $alias_2 = "virus.win32.neshta" ascii wide nocase
        $alias_3 = "win32/neshta" ascii wide nocase
        $alias_4 = "w32.neshta.a" ascii wide nocase
        $alias_5 = "virus:win32/neshta" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NESHTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Neshta tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neshta"
        date = "2026-10-16"
    strings:
        $attrib_str = "neshta" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Netbus (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netbus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETBUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netbus (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netbus"
        date = "2026-10-16"
    strings:
        $fam_name = "netbus" ascii wide nocase
        $alias_1 = "netbus" ascii wide nocase
        $alias_2 = "netbus pro" ascii wide nocase
        $alias_3 = "patch.netbus" ascii wide nocase
        $alias_4 = "backdoor.netbus" ascii wide nocase
        $alias_5 = "trojan.netbus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETBUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netbus tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netbus"
        date = "2026-10-16"
    strings:
        $attrib_str = "netbus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Netcat (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netcat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETCAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netcat (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netcat"
        date = "2026-10-16"
    strings:
        $fam_name = "netcat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETCAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netcat tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netcat"
        date = "2026-10-16"
    strings:
        $attrib_str = "netcat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Netdevil (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netdevil
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETDEVIL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netdevil (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netdevil"
        date = "2026-10-16"
    strings:
        $fam_name = "netdevil" ascii wide nocase
        $alias_1 = "backdoor.netdevil" ascii wide nocase
        $alias_2 = "trojan.netdevil" ascii wide nocase
        $alias_3 = "win32/netdevil" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETDEVIL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netdevil tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netdevil"
        date = "2026-10-16"
    strings:
        $attrib_str = "netdevil" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Netinject (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netinject
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETINJECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netinject (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netinject"
        date = "2026-10-16"
    strings:
        $fam_name = "netinject" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETINJECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netinject tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netinject"
        date = "2026-10-16"
    strings:
        $attrib_str = "netinject" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Netpass (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netpass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netpass (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netpass"
        date = "2026-10-16"
    strings:
        $fam_name = "netpass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netpass tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netpass"
        date = "2026-10-16"
    strings:
        $attrib_str = "netpass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Netshadow (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netshadow
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETSHADOW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netshadow (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netshadow"
        date = "2026-10-16"
    strings:
        $fam_name = "netshadow" ascii wide nocase
        $alias_1 = "trojan.netshadow" ascii wide nocase
        $alias_2 = "keylogger.netshadow" ascii wide nocase
        $alias_3 = "spyware.netshadow" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETSHADOW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netshadow tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netshadow"
        date = "2026-10-16"
    strings:
        $attrib_str = "netshadow" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Netshrink (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netshrink
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETSHRINK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netshrink (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netshrink"
        date = "2026-10-16"
    strings:
        $fam_name = "netshrink" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETSHRINK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netshrink tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netshrink"
        date = "2026-10-16"
    strings:
        $attrib_str = "netshrink" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Netsky (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netsky
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETSKY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netsky (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netsky"
        date = "2026-10-16"
    strings:
        $fam_name = "netsky" ascii wide nocase
        $alias_1 = "netsky" ascii wide nocase
        $alias_2 = "worm.win32.netsky" ascii wide nocase
        $alias_3 = "w32/netsky" ascii wide nocase
        $alias_4 = "win32.netsky" ascii wide nocase
        $alias_5 = "moodown" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETSKY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netsky tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netsky"
        date = "2026-10-16"
    strings:
        $attrib_str = "netsky" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Netsphere (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netsphere
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETSPHERE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netsphere (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netsphere"
        date = "2026-10-16"
    strings:
        $fam_name = "netsphere" ascii wide nocase
        $alias_1 = "backdoor:win32/netsphere" ascii wide nocase
        $alias_2 = "trojan.win32.netsphere" ascii wide nocase
        $alias_3 = "backdoor.netsphere" ascii wide nocase
        $alias_4 = "win32/netsphere.rat" ascii wide nocase
        $alias_5 = "netsphere.server" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETSPHERE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netsphere tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netsphere"
        date = "2026-10-16"
    strings:
        $attrib_str = "netsphere" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Netstream (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netstream
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETSTREAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netstream (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netstream"
        date = "2026-10-16"
    strings:
        $fam_name = "netstream" ascii wide nocase
        $alias_1 = "backdoor:win32/netstream" ascii wide nocase
        $alias_2 = "trojan:win32/netstream" ascii wide nocase
        $alias_3 = "win32/netstream" ascii wide nocase
        $alias_4 = "backdoor.netstream" ascii wide nocase
        $alias_5 = "netstream rat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETSTREAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netstream tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netstream"
        date = "2026-10-16"
    strings:
        $attrib_str = "netstream" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Netthief (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netthief
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETTHIEF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netthief (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netthief"
        date = "2026-10-16"
    strings:
        $fam_name = "netthief" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETTHIEF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netthief tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netthief"
        date = "2026-10-16"
    strings:
        $attrib_str = "netthief" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nettool (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nettool
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETTOOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nettool (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nettool"
        date = "2026-10-16"
    strings:
        $fam_name = "nettool" ascii wide nocase
        $alias_1 = "hacktool:win32/nettool" ascii wide nocase
        $alias_2 = "tool:win32/nettool" ascii wide nocase
        $alias_3 = "trojan:win32/nettool" ascii wide nocase
        $alias_4 = "win32/nettool" ascii wide nocase
        $alias_5 = "nettool scanner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETTOOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nettool tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nettool"
        date = "2026-10-16"
    strings:
        $attrib_str = "nettool" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Netwire (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netwire
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETWIRE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netwire (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netwire"
        date = "2026-10-16"
    strings:
        $fam_name = "netwire" ascii wide nocase
        $alias_1 = "rat.netwire" ascii wide nocase
        $alias_2 = "backdoor.netwire" ascii wide nocase
        $alias_3 = "win32/netwire" ascii wide nocase
        $alias_4 = "netwire.rc" ascii wide nocase
        $alias_5 = "trojan:win32/netwire" ascii wide nocase
        $alias_6 = "world wired labs netwire" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETWIRE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netwire tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netwire"
        date = "2026-10-16"
    strings:
        $attrib_str = "netwire" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Netwiredrc (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/netwiredrc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NETWIREDRC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Netwiredrc (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netwiredrc"
        date = "2026-10-16"
    strings:
        $fam_name = "netwiredrc" ascii wide nocase
        $alias_1 = "netwire" ascii wide nocase
        $alias_2 = "netwire rat" ascii wide nocase
        $alias_3 = "netwiredrc" ascii wide nocase
        $alias_4 = "trojan:win32/netwire" ascii wide nocase
        $alias_5 = "backdoor.netwire" ascii wide nocase
        $alias_6 = "worldwiredlabs netwire" ascii wide nocase
        $alias_7 = "trojan.netwire" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NETWIREDRC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Netwiredrc tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/netwiredrc"
        date = "2026-10-16"
    strings:
        $attrib_str = "netwiredrc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Neurevt (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/neurevt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEUREVT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Neurevt (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neurevt"
        date = "2026-10-16"
    strings:
        $fam_name = "neurevt" ascii wide nocase
        $alias_1 = "trojan:win32/neurevt" ascii wide nocase
        $alias_2 = "beta bot" ascii wide nocase
        $alias_3 = "trojan.win32.neurevt" ascii wide nocase
        $alias_4 = "win32/neurevt" ascii wide nocase
        $alias_5 = "betabot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEUREVT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Neurevt tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neurevt"
        date = "2026-10-16"
    strings:
        $attrib_str = "neurevt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Neutrinopos (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/neutrinopos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEUTRINOPOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Neutrinopos (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neutrinopos"
        date = "2026-10-16"
    strings:
        $fam_name = "neutrinopos" ascii wide nocase
        $alias_1 = "trojan:win32/neutrinopos" ascii wide nocase
        $alias_2 = "trojan:win32/kasidet" ascii wide nocase
        $alias_3 = "kasidet" ascii wide nocase
        $alias_4 = "mwzlesson" ascii wide nocase
        $alias_5 = "neutrinobot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEUTRINOPOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Neutrinopos tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/neutrinopos"
        date = "2026-10-16"
    strings:
        $attrib_str = "neutrinopos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Newheur (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/newheur
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NEWHEUR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Newheur (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/newheur"
        date = "2026-10-16"
    strings:
        $fam_name = "newheur" ascii wide nocase
        $alias_1 = "trojan.newheur" ascii wide nocase
        $alias_2 = "heur:trojan.win32.generic" ascii wide nocase
        $alias_3 = "suspicious.newheur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NEWHEUR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Newheur tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/newheur"
        date = "2026-10-16"
    strings:
        $attrib_str = "newheur" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ngrbot (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ngrbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NGRBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ngrbot (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ngrbot"
        date = "2026-10-16"
    strings:
        $fam_name = "ngrbot" ascii wide nocase
        $alias_1 = "worm:win32/dorkbot" ascii wide nocase
        $alias_2 = "worm.win32.ngrbot" ascii wide nocase
        $alias_3 = "ngrbot" ascii wide nocase
        $alias_4 = "dorkbot" ascii wide nocase
        $alias_5 = "w32.ircbot.ng" ascii wide nocase
        $alias_6 = "win32/dorkbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NGRBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ngrbot tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ngrbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "ngrbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ngvck (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ngvck
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NGVCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ngvck (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ngvck"
        date = "2026-10-16"
    strings:
        $fam_name = "ngvck" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NGVCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ngvck tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ngvck"
        date = "2026-10-16"
    strings:
        $attrib_str = "ngvck" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nhopro (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nhopro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NHOPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nhopro (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nhopro"
        date = "2026-10-16"
    strings:
        $fam_name = "nhopro" ascii wide nocase
        $alias_1 = "adware.nhopro" ascii wide nocase
        $alias_2 = "pup.nhopro" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NHOPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nhopro tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nhopro"
        date = "2026-10-16"
    strings:
        $attrib_str = "nhopro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nicehashminer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nicehashminer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NICEHASHMINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nicehashminer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nicehashminer"
        date = "2026-10-16"
    strings:
        $fam_name = "nicehashminer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NICEHASHMINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nicehashminer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nicehashminer"
        date = "2026-10-16"
    strings:
        $attrib_str = "nicehashminer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nieguide (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nieguide
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NIEGUIDE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nieguide (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nieguide"
        date = "2026-10-16"
    strings:
        $fam_name = "nieguide" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NIEGUIDE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nieguide tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nieguide"
        date = "2026-10-16"
    strings:
        $attrib_str = "nieguide" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nilage (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nilage
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NILAGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nilage (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nilage"
        date = "2026-10-16"
    strings:
        $fam_name = "nilage" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NILAGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nilage tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nilage"
        date = "2026-10-16"
    strings:
        $attrib_str = "nilage" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nilaspo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nilaspo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NILASPO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nilaspo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nilaspo"
        date = "2026-10-16"
    strings:
        $fam_name = "nilaspo" ascii wide nocase
        $alias_1 = "trojan.nilaspo" ascii wide nocase
        $alias_2 = "downloader.nilaspo" ascii wide nocase
        $alias_3 = "win32/nilaspo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NILASPO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nilaspo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nilaspo"
        date = "2026-10-16"
    strings:
        $attrib_str = "nilaspo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nion (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nion
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NION_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nion (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nion"
        date = "2026-10-16"
    strings:
        $fam_name = "nion" ascii wide nocase
        $alias_1 = "trojan.nion" ascii wide nocase
        $alias_2 = "downloader.nion" ascii wide nocase
        $alias_3 = "win32/nion" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NION_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nion tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nion"
        date = "2026-10-16"
    strings:
        $attrib_str = "nion" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nircmd (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nircmd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NIRCMD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nircmd (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nircmd"
        date = "2026-10-16"
    strings:
        $fam_name = "nircmd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NIRCMD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nircmd tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nircmd"
        date = "2026-10-16"
    strings:
        $attrib_str = "nircmd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nirsoft (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nirsoft
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NIRSOFT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nirsoft (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nirsoft"
        date = "2026-10-16"
    strings:
        $fam_name = "nirsoft" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NIRSOFT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nirsoft tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nirsoft"
        date = "2026-10-16"
    strings:
        $attrib_str = "nirsoft" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nisloder (Loader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nisloder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NISLODER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nisloder (Loader)"
        category = "Loader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nisloder"
        date = "2026-10-16"
    strings:
        $fam_name = "nisloder" ascii wide nocase
        $alias_1 = "trojandownloader:win32/nisloder" ascii wide nocase
        $alias_2 = "trojan:win32/nisloder" ascii wide nocase
        $alias_3 = "nisloder loader" ascii wide nocase
        $alias_4 = "win32/nisloder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NISLODER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nisloder tradecraft"
        category = "Loader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nisloder"
        date = "2026-10-16"
    strings:
        $attrib_str = "nisloder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nistio (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nistio
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NISTIO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nistio (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nistio"
        date = "2026-10-16"
    strings:
        $fam_name = "nistio" ascii wide nocase
        $alias_1 = "trojan.nistio" ascii wide nocase
        $alias_2 = "downloader.nistio" ascii wide nocase
        $alias_3 = "win32/nistio" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NISTIO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nistio tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nistio"
        date = "2026-10-16"
    strings:
        $attrib_str = "nistio" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nitol (Ddos_Bot)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nitol
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NITOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nitol (Ddos_Bot)"
        category = "Ddos_Bot"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nitol"
        date = "2026-10-16"
    strings:
        $fam_name = "nitol" ascii wide nocase
        $alias_1 = "ddos:win32/nitol" ascii wide nocase
        $alias_2 = "trojan:win32/nitol" ascii wide nocase
        $alias_3 = "backdoor.win32.nitol" ascii wide nocase
        $alias_4 = "win32/nitol.bot" ascii wide nocase
        $alias_5 = "nitol.ddos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NITOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nitol tradecraft"
        category = "Ddos_Bot"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nitol"
        date = "2026-10-16"
    strings:
        $attrib_str = "nitol" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nitter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nitter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NITTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nitter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nitter"
        date = "2026-10-16"
    strings:
        $fam_name = "nitter" ascii wide nocase
        $alias_1 = "trojan.nitter" ascii wide nocase
        $alias_2 = "downloader.nitter" ascii wide nocase
        $alias_3 = "win32/nitter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NITTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nitter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nitter"
        date = "2026-10-16"
    strings:
        $attrib_str = "nitter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nivdort (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nivdort
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NIVDORT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nivdort (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nivdort"
        date = "2026-10-16"
    strings:
        $fam_name = "nivdort" ascii wide nocase
        $alias_1 = "trojan.nivdort" ascii wide nocase
        $alias_2 = "botnet.bayrob" ascii wide nocase
        $alias_3 = "win32/nivdort" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NIVDORT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nivdort tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nivdort"
        date = "2026-10-16"
    strings:
        $attrib_str = "nivdort" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Niwaa8Lfbrj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/niwaa8lfbrj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NIWAA8LFBRJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Niwaa8Lfbrj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/niwaa8lfbrj"
        date = "2026-10-16"
    strings:
        $fam_name = "niwaa8lfbrj" ascii wide nocase
        $alias_1 = "trojan.niwaa8lfbrj" ascii wide nocase
        $alias_2 = "win32/trojan.obfuscated" ascii wide nocase
        $alias_3 = "suspicious.dga" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NIWAA8LFBRJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Niwaa8Lfbrj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/niwaa8lfbrj"
        date = "2026-10-16"
    strings:
        $attrib_str = "niwaa8lfbrj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Njlogger (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/njlogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NJLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Njlogger (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/njlogger"
        date = "2026-10-16"
    strings:
        $fam_name = "njlogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NJLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Njlogger tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/njlogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "njlogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Njrat (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/njrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NJRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Njrat (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/njrat"
        date = "2026-10-16"
    strings:
        $fam_name = "njrat" ascii wide nocase
        $alias_1 = "bladabindi" ascii wide nocase
        $alias_2 = "njw0rm" ascii wide nocase
        $alias_3 = "backdoor:msil/bladabindi" ascii wide nocase
        $alias_4 = "trojan.msil.njrat" ascii wide nocase
        $alias_5 = "win32/bladabindi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NJRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Njrat tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/njrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "njrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Nlbrute (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nlbrute
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NLBRUTE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nlbrute (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nlbrute"
        date = "2026-10-16"
    strings:
        $fam_name = "nlbrute" ascii wide nocase
        $alias_1 = "hacktool.nlbrute" ascii wide nocase
        $alias_2 = "rdp.bruteforcer" ascii wide nocase
        $alias_3 = "win32/nlbrute" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NLBRUTE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nlbrute tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nlbrute"
        date = "2026-10-16"
    strings:
        $attrib_str = "nlbrute" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nmkfacwya3Cg (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nmkfacwya3cg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NMKFACWYA3CG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nmkfacwya3Cg (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nmkfacwya3cg"
        date = "2026-10-16"
    strings:
        $fam_name = "nmkfacwya3cg" ascii wide nocase
        $alias_1 = "trojan.generic.nmkfacwya3cg" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NMKFACWYA3CG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nmkfacwya3Cg tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nmkfacwya3cg"
        date = "2026-10-16"
    strings:
        $attrib_str = "nmkfacwya3cg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nmkfxmdtnmoi (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nmkfxmdtnmoi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NMKFXMDTNMOI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nmkfxmdtnmoi (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nmkfxmdtnmoi"
        date = "2026-10-16"
    strings:
        $fam_name = "nmkfxmdtnmoi" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.nmkfxmdtnmoi" ascii wide nocase
        $alias_3 = "heur.nmkfxmdtnmoi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NMKFXMDTNMOI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nmkfxmdtnmoi tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nmkfxmdtnmoi"
        date = "2026-10-16"
    strings:
        $attrib_str = "nmkfxmdtnmoi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Noancooe (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/noancooe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NOANCOOE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Noancooe (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/noancooe"
        date = "2026-10-16"
    strings:
        $fam_name = "noancooe" ascii wide nocase
        $alias_1 = "backdoor:msil/noancooe" ascii wide nocase
        $alias_2 = "trojan:win32/noancooe" ascii wide nocase
        $alias_3 = "backdoor.msil.noancooe" ascii wide nocase
        $alias_4 = "win32/noancooe" ascii wide nocase
        $alias_5 = "trojan.noancooe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NOANCOOE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Noancooe tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/noancooe"
        date = "2026-10-16"
    strings:
        $attrib_str = "noancooe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Noobyprotect (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/noobyprotect
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NOOBYPROTECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Noobyprotect (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/noobyprotect"
        date = "2026-10-16"
    strings:
        $fam_name = "noobyprotect" ascii wide nocase
        $alias_1 = "softwarebundler:win32/noobyprotect" ascii wide nocase
        $alias_2 = "trojan.malpack.np" ascii wide nocase
        $alias_3 = "pua:win32/noobyprotect" ascii wide nocase
        $alias_4 = "win32.packed.noobyprotect" ascii wide nocase
        $alias_5 = "packer:win32/noobyprotect" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NOOBYPROTECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Noobyprotect tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/noobyprotect"
        date = "2026-10-16"
    strings:
        $attrib_str = "noobyprotect" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Noon (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/noon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NOON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Noon (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/noon"
        date = "2026-10-16"
    strings:
        $fam_name = "noon" ascii wide nocase
        $alias_1 = "adware:win32/noon" ascii wide nocase
        $alias_2 = "browsermodifier:win32/noon" ascii wide nocase
        $alias_3 = "win32/noon.adware" ascii wide nocase
        $alias_4 = "pup.optional.noon" ascii wide nocase
        $alias_5 = "adware.noon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NOON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Noon tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/noon"
        date = "2026-10-16"
    strings:
        $attrib_str = "noon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Noonlight (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/noonlight
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NOONLIGHT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Noonlight (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/noonlight"
        date = "2026-10-16"
    strings:
        $fam_name = "noonlight" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NOONLIGHT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Noonlight tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/noonlight"
        date = "2026-10-16"
    strings:
        $attrib_str = "noonlight" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nosok (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nosok
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NOSOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nosok (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nosok"
        date = "2026-10-16"
    strings:
        $fam_name = "nosok" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NOSOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nosok tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nosok"
        date = "2026-10-16"
    strings:
        $attrib_str = "nosok" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nottotrack (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nottotrack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NOTTOTRACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nottotrack (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nottotrack"
        date = "2026-10-16"
    strings:
        $fam_name = "nottotrack" ascii wide nocase
        $alias_1 = "adware.nottotrack" ascii wide nocase
        $alias_2 = "pup.nottotrack" ascii wide nocase
        $alias_3 = "spyware.tracker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NOTTOTRACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nottotrack tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nottotrack"
        date = "2026-10-16"
    strings:
        $attrib_str = "nottotrack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Noupack (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/noupack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NOUPACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Noupack (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/noupack"
        date = "2026-10-16"
    strings:
        $fam_name = "noupack" ascii wide nocase
        $alias_1 = "trojan.noupack" ascii wide nocase
        $alias_2 = "packed.noupack" ascii wide nocase
        $alias_3 = "win32/noupack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NOUPACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Noupack tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/noupack"
        date = "2026-10-16"
    strings:
        $attrib_str = "noupack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Npack (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/npack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NPACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Npack (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/npack"
        date = "2026-10-16"
    strings:
        $fam_name = "npack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NPACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Npack tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/npack"
        date = "2026-10-16"
    strings:
        $attrib_str = "npack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Npgi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/npgi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NPGI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Npgi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/npgi"
        date = "2026-10-16"
    strings:
        $fam_name = "npgi" ascii wide nocase
        $alias_1 = "trojan.npgi" ascii wide nocase
        $alias_2 = "downloader.npgi" ascii wide nocase
        $alias_3 = "win32/npgi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NPGI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Npgi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/npgi"
        date = "2026-10-16"
    strings:
        $attrib_str = "npgi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nrww (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nrww
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NRWW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nrww (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nrww"
        date = "2026-10-16"
    strings:
        $fam_name = "nrww" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NRWW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nrww tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nrww"
        date = "2026-10-16"
    strings:
        $attrib_str = "nrww" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nsanti (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nsanti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NSANTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nsanti (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nsanti"
        date = "2026-10-16"
    strings:
        $fam_name = "nsanti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NSANTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nsanti tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nsanti"
        date = "2026-10-16"
    strings:
        $attrib_str = "nsanti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nscauth (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nscauth
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NSCAUTH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nscauth (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nscauth"
        date = "2026-10-16"
    strings:
        $fam_name = "nscauth" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NSCAUTH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nscauth tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nscauth"
        date = "2026-10-16"
    strings:
        $attrib_str = "nscauth" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nsismod (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nsismod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NSISMOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nsismod (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nsismod"
        date = "2026-10-16"
    strings:
        $fam_name = "nsismod" ascii wide nocase
        $alias_1 = "pua.win32.nsismod" ascii wide nocase
        $alias_2 = "trojan:win32/nsismod" ascii wide nocase
        $alias_3 = "adware.nsismod" ascii wide nocase
        $alias_4 = "pua:win32/nsismod" ascii wide nocase
        $alias_5 = "trojan-dropper.win32.nsismod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NSISMOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nsismod tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nsismod"
        date = "2026-10-16"
    strings:
        $attrib_str = "nsismod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Nspm (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nspm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NSPM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nspm (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nspm"
        date = "2026-10-16"
    strings:
        $fam_name = "nspm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NSPM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nspm tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nspm"
        date = "2026-10-16"
    strings:
        $attrib_str = "nspm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nssm (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nssm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NSSM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nssm (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nssm"
        date = "2026-10-16"
    strings:
        $fam_name = "nssm" ascii wide nocase
        $alias_1 = "hacktool:win32/nssm" ascii wide nocase
        $alias_2 = "tool:win32/nssm" ascii wide nocase
        $alias_3 = "pua:win32/nssm" ascii wide nocase
        $alias_4 = "non-sucking service manager" ascii wide nocase
        $alias_5 = "win32/nssm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NSSM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nssm tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nssm"
        date = "2026-10-16"
    strings:
        $attrib_str = "nssm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ntkrnl (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ntkrnl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NTKRNL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ntkrnl (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ntkrnl"
        date = "2026-10-16"
    strings:
        $fam_name = "ntkrnl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NTKRNL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ntkrnl tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ntkrnl"
        date = "2026-10-16"
    strings:
        $attrib_str = "ntkrnl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ntrootkit (Rootkit)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ntrootkit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NTROOTKIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ntrootkit (Rootkit)"
        category = "Rootkit"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ntrootkit"
        date = "2026-10-16"
    strings:
        $fam_name = "ntrootkit" ascii wide nocase
        $alias_1 = "rootkit:win32/ntrootkit" ascii wide nocase
        $alias_2 = "win32/ntrootkit" ascii wide nocase
        $alias_3 = "rootkit.ntroot" ascii wide nocase
        $alias_4 = "ntroot kernel driver" ascii wide nocase
        $alias_5 = "trojan:win32/ntrootkit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NTROOTKIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ntrootkit tradecraft"
        category = "Rootkit"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ntrootkit"
        date = "2026-10-16"
    strings:
        $attrib_str = "ntrootkit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nuclear_Rat (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nuclear_rat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NUCLEAR_RAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nuclear_Rat (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nuclear_rat"
        date = "2026-10-16"
    strings:
        $fam_name = "nuclear_rat" ascii wide nocase
        $alias_1 = "nuclearrat" ascii wide nocase
        $alias_2 = "nuclear rat 2.1" ascii wide nocase
        $alias_3 = "backdoor.nuclearrat" ascii wide nocase
        $alias_4 = "trojan.nuclearrat" ascii wide nocase
        $alias_5 = "win32/nuclearrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NUCLEAR_RAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nuclear_Rat tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nuclear_rat"
        date = "2026-10-16"
    strings:
        $attrib_str = "nuclear_rat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Nukesped (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nukesped
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NUKESPED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nukesped (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nukesped"
        date = "2026-10-16"
    strings:
        $fam_name = "nukesped" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NUKESPED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nukesped tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nukesped"
        date = "2026-10-16"
    strings:
        $attrib_str = "nukesped" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Nussamoc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nussamoc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NUSSAMOC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nussamoc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nussamoc"
        date = "2026-10-16"
    strings:
        $fam_name = "nussamoc" ascii wide nocase
        $alias_1 = "trojan.nussamoc" ascii wide nocase
        $alias_2 = "downloader.nussamoc" ascii wide nocase
        $alias_3 = "win32/nussamoc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NUSSAMOC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nussamoc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nussamoc"
        date = "2026-10-16"
    strings:
        $attrib_str = "nussamoc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nymaim (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nymaim
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NYMAIM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nymaim (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nymaim"
        date = "2026-10-16"
    strings:
        $fam_name = "nymaim" ascii wide nocase
        $alias_1 = "nymaim" ascii wide nocase
        $alias_2 = "win32/nymaim" ascii wide nocase
        $alias_3 = "trojan.nymaim" ascii wide nocase
        $alias_4 = "goznym precursor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NYMAIM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nymaim tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nymaim"
        date = "2026-10-16"
    strings:
        $attrib_str = "nymaim" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nymeria (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nymeria
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NYMERIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nymeria (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nymeria"
        date = "2026-10-16"
    strings:
        $fam_name = "nymeria" ascii wide nocase
        $alias_1 = "trojandownloader:win32/nymeria" ascii wide nocase
        $alias_2 = "trojan.nymeria" ascii wide nocase
        $alias_3 = "win32/nymeria" ascii wide nocase
        $alias_4 = "backdoor:win32/nymeria" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NYMERIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nymeria tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nymeria"
        date = "2026-10-16"
    strings:
        $attrib_str = "nymeria" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Nystprac (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nystprac
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NYSTPRAC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nystprac (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nystprac"
        date = "2026-10-16"
    strings:
        $fam_name = "nystprac" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NYSTPRAC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nystprac tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nystprac"
        date = "2026-10-16"
    strings:
        $attrib_str = "nystprac" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Nyxem (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/nyxem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_NYXEM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nyxem (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nyxem"
        date = "2026-10-16"
    strings:
        $fam_name = "nyxem" ascii wide nocase
        $alias_1 = "w32.nyxem" ascii wide nocase
        $alias_2 = "worm.kamasutra" ascii wide nocase
        $alias_3 = "w32/blackmal" ascii wide nocase
        $alias_4 = "worm:win32/mywife" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_NYXEM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nyxem tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/nyxem"
        date = "2026-10-16"
    strings:
        $attrib_str = "nyxem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Oasisminus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oasisminus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OASISMINUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oasisminus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oasisminus"
        date = "2026-10-16"
    strings:
        $fam_name = "oasisminus" ascii wide nocase
        $alias_1 = "trojan.oasisminus" ascii wide nocase
        $alias_2 = "downloader.oasisminus" ascii wide nocase
        $alias_3 = "win32/oasisminus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OASISMINUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oasisminus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oasisminus"
        date = "2026-10-16"
    strings:
        $attrib_str = "oasisminus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Obfusransom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/obfusransom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OBFUSRANSOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Obfusransom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/obfusransom"
        date = "2026-10-16"
    strings:
        $fam_name = "obfusransom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OBFUSRANSOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Obfusransom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/obfusransom"
        date = "2026-10-16"
    strings:
        $attrib_str = "obfusransom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Obrypser (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/obrypser
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OBRYPSER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Obrypser (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/obrypser"
        date = "2026-10-16"
    strings:
        $fam_name = "obrypser" ascii wide nocase
        $alias_1 = "trojan.obrypser" ascii wide nocase
        $alias_2 = "downloader.obrypser" ascii wide nocase
        $alias_3 = "win32/obrypser" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OBRYPSER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Obrypser tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/obrypser"
        date = "2026-10-16"
    strings:
        $attrib_str = "obrypser" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Obsidium (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/obsidium
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OBSIDIUM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Obsidium (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/obsidium"
        date = "2026-10-16"
    strings:
        $fam_name = "obsidium" ascii wide nocase
        $alias_1 = "packer:win32/obsidium" ascii wide nocase
        $alias_2 = "trojan:win32/obsidium" ascii wide nocase
        $alias_3 = "trojan-ransom.win32.obsidium" ascii wide nocase
        $alias_4 = "packer.obsidium" ascii wide nocase
        $alias_5 = "win32/obsidium" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OBSIDIUM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Obsidium tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/obsidium"
        date = "2026-10-16"
    strings:
        $attrib_str = "obsidium" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Occamy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/occamy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OCCAMY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Occamy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/occamy"
        date = "2026-10-16"
    strings:
        $fam_name = "occamy" ascii wide nocase
        $alias_1 = "occamy" ascii wide nocase
        $alias_2 = "trojan:win32/occamy.c" ascii wide nocase
        $alias_3 = "trojan:win32/occamy" ascii wide nocase
        $alias_4 = "win32/occamy" ascii wide nocase
        $alias_5 = "occamy dropper" ascii wide nocase
        $alias_6 = "trojan.occamy" ascii wide nocase
        $alias_7 = "occamy stealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OCCAMY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Occamy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/occamy"
        date = "2026-10-16"
    strings:
        $attrib_str = "occamy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Oceanlotus (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oceanlotus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OCEANLOTUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oceanlotus (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oceanlotus"
        date = "2026-10-16"
    strings:
        $fam_name = "oceanlotus" ascii wide nocase
        $alias_1 = "apt32" ascii wide nocase
        $alias_2 = "canvas assassin" ascii wide nocase
        $alias_3 = "sealotus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OCEANLOTUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oceanlotus tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oceanlotus"
        date = "2026-10-16"
    strings:
        $attrib_str = "oceanlotus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Ocna (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ocna
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OCNA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ocna (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ocna"
        date = "2026-10-16"
    strings:
        $fam_name = "ocna" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OCNA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ocna tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ocna"
        date = "2026-10-16"
    strings:
        $attrib_str = "ocna" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Octopus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/octopus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OCTOPUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Octopus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/octopus"
        date = "2026-10-16"
    strings:
        $fam_name = "octopus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OCTOPUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Octopus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/octopus"
        date = "2026-10-16"
    strings:
        $attrib_str = "octopus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Oepass (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oepass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OEPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oepass (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oepass"
        date = "2026-10-16"
    strings:
        $fam_name = "oepass" ascii wide nocase
        $alias_1 = "hacktool.oepass" ascii wide nocase
        $alias_2 = "passwordstealer.oepass" ascii wide nocase
        $alias_3 = "riskware.oepass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OEPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oepass tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oepass"
        date = "2026-10-16"
    strings:
        $attrib_str = "oepass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Offend (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/offend
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OFFEND_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Offend (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/offend"
        date = "2026-10-16"
    strings:
        $fam_name = "offend" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OFFEND_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Offend tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/offend"
        date = "2026-10-16"
    strings:
        $attrib_str = "offend" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Offerbox (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/offerbox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OFFERBOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Offerbox (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/offerbox"
        date = "2026-10-16"
    strings:
        $fam_name = "offerbox" ascii wide nocase
        $alias_1 = "adware.offerbox" ascii wide nocase
        $alias_2 = "pup.offerbox" ascii wide nocase
        $alias_3 = "win32/offerbox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OFFERBOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Offerbox tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/offerbox"
        date = "2026-10-16"
    strings:
        $attrib_str = "offerbox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Offergenerator (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/offergenerator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OFFERGENERATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Offergenerator (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/offergenerator"
        date = "2026-10-16"
    strings:
        $fam_name = "offergenerator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OFFERGENERATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Offergenerator tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/offergenerator"
        date = "2026-10-16"
    strings:
        $attrib_str = "offergenerator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Offerinstall (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/offerinstall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OFFERINSTALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Offerinstall (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/offerinstall"
        date = "2026-10-16"
    strings:
        $fam_name = "offerinstall" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OFFERINSTALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Offerinstall tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/offerinstall"
        date = "2026-10-16"
    strings:
        $attrib_str = "offerinstall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Offtoup (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/offtoup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OFFTOUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Offtoup (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/offtoup"
        date = "2026-10-16"
    strings:
        $fam_name = "offtoup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OFFTOUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Offtoup tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/offtoup"
        date = "2026-10-16"
    strings:
        $attrib_str = "offtoup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Oficla (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oficla
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OFICLA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oficla (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oficla"
        date = "2026-10-16"
    strings:
        $fam_name = "oficla" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OFICLA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oficla tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oficla"
        date = "2026-10-16"
    strings:
        $attrib_str = "oficla" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Oflwr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oflwr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OFLWR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oflwr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oflwr"
        date = "2026-10-16"
    strings:
        $fam_name = "oflwr" ascii wide nocase
        $alias_1 = "trojan.oflwr" ascii wide nocase
        $alias_2 = "downloader.oflwr" ascii wide nocase
        $alias_3 = "win32/oflwr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OFLWR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oflwr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oflwr"
        date = "2026-10-16"
    strings:
        $attrib_str = "oflwr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ohmytabs (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ohmytabs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OHMYTABS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ohmytabs (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ohmytabs"
        date = "2026-10-16"
    strings:
        $fam_name = "ohmytabs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OHMYTABS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ohmytabs tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ohmytabs"
        date = "2026-10-16"
    strings:
        $attrib_str = "ohmytabs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Olala (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/olala
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OLALA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Olala (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/olala"
        date = "2026-10-16"
    strings:
        $fam_name = "olala" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OLALA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Olala tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/olala"
        date = "2026-10-16"
    strings:
        $attrib_str = "olala" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Olext (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/olext
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OLEXT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Olext (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/olext"
        date = "2026-10-16"
    strings:
        $fam_name = "olext" ascii wide nocase
        $alias_1 = "adware.olext" ascii wide nocase
        $alias_2 = "pup.olext" ascii wide nocase
        $alias_3 = "win32/adware.extension" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OLEXT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Olext tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/olext"
        date = "2026-10-16"
    strings:
        $attrib_str = "olext" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Olgames (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/olgames
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OLGAMES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Olgames (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/olgames"
        date = "2026-10-16"
    strings:
        $fam_name = "olgames" ascii wide nocase
        $alias_1 = "onlinegames" ascii wide nocase
        $alias_2 = "pws:win32/onlinegames" ascii wide nocase
        $alias_3 = "trojan-psw.win32.onlinegames" ascii wide nocase
        $alias_4 = "trojan.onlinegames" ascii wide nocase
        $alias_5 = "psw.onlinegames" ascii wide nocase
        $alias_6 = "win32/onlinegames" ascii wide nocase
        $alias_7 = "trojan-psw.onlinegames" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OLGAMES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Olgames tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/olgames"
        date = "2026-10-16"
    strings:
        $attrib_str = "olgames" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Oligo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oligo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OLIGO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oligo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oligo"
        date = "2026-10-16"
    strings:
        $fam_name = "oligo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OLIGO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oligo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oligo"
        date = "2026-10-16"
    strings:
        $attrib_str = "oligo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Olympicdestroyer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/olympicdestroyer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OLYMPICDESTROYER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Olympicdestroyer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/olympicdestroyer"
        date = "2026-10-16"
    strings:
        $fam_name = "olympicdestroyer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OLYMPICDESTROYER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Olympicdestroyer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/olympicdestroyer"
        date = "2026-10-16"
    strings:
        $attrib_str = "olympicdestroyer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Omaneat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/omaneat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OMANEAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Omaneat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/omaneat"
        date = "2026-10-16"
    strings:
        $fam_name = "omaneat" ascii wide nocase
        $alias_1 = "trojan:win32/omaneat" ascii wide nocase
        $alias_2 = "spyware:win32/omaneat!pz" ascii wide nocase
        $alias_3 = "trojanspy:msil/omaneat" ascii wide nocase
        $alias_4 = "win32/omaneat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OMANEAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Omaneat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/omaneat"
        date = "2026-10-16"
    strings:
        $attrib_str = "omaneat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Omgfamcremci (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/omgfamcremci
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OMGFAMCREMCI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Omgfamcremci (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/omgfamcremci"
        date = "2026-10-16"
    strings:
        $fam_name = "omgfamcremci" ascii wide nocase
        $alias_1 = "trojan.generic.omgfamcremci" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OMGFAMCREMCI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Omgfamcremci tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/omgfamcremci"
        date = "2026-10-16"
    strings:
        $attrib_str = "omgfamcremci" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Omyaamfbexii (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/omyaamfbexii
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OMYAAMFBEXII_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Omyaamfbexii (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/omyaamfbexii"
        date = "2026-10-16"
    strings:
        $fam_name = "omyaamfbexii" ascii wide nocase
        $alias_1 = "generic.omyaamfbexii" ascii wide nocase
        $alias_2 = "trojan.generic" ascii wide nocase
        $alias_3 = "dga.generic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OMYAAMFBEXII_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Omyaamfbexii tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/omyaamfbexii"
        date = "2026-10-16"
    strings:
        $attrib_str = "omyaamfbexii" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Oneclick (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oneclick
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ONECLICK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oneclick (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oneclick"
        date = "2026-10-16"
    strings:
        $fam_name = "oneclick" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ONECLICK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oneclick tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oneclick"
        date = "2026-10-16"
    strings:
        $attrib_str = "oneclick" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Oneclickdownloader (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oneclickdownloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ONECLICKDOWNLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oneclickdownloader (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oneclickdownloader"
        date = "2026-10-16"
    strings:
        $fam_name = "oneclickdownloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ONECLICKDOWNLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oneclickdownloader tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oneclickdownloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "oneclickdownloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Oneinstaller (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oneinstaller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ONEINSTALLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oneinstaller (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oneinstaller"
        date = "2026-10-16"
    strings:
        $fam_name = "oneinstaller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ONEINSTALLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oneinstaller tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oneinstaller"
        date = "2026-10-16"
    strings:
        $attrib_str = "oneinstaller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Onescan (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/onescan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ONESCAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Onescan (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/onescan"
        date = "2026-10-16"
    strings:
        $fam_name = "onescan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ONESCAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Onescan tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/onescan"
        date = "2026-10-16"
    strings:
        $attrib_str = "onescan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Onesyscare (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/onesyscare
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ONESYSCARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Onesyscare (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/onesyscare"
        date = "2026-10-16"
    strings:
        $fam_name = "onesyscare" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ONESYSCARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Onesyscare tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/onesyscare"
        date = "2026-10-16"
    strings:
        $attrib_str = "onesyscare" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Onesystemcare (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/onesystemcare
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ONESYSTEMCARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Onesystemcare (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/onesystemcare"
        date = "2026-10-16"
    strings:
        $fam_name = "onesystemcare" ascii wide nocase
        $alias_1 = "pua:win32/onesystemcare" ascii wide nocase
        $alias_2 = "program:win32/onesystemcare" ascii wide nocase
        $alias_3 = "onesystemcare optimizer" ascii wide nocase
        $alias_4 = "rogue:win32/onesystemcare" ascii wide nocase
        $alias_5 = "win32/onesystemcare" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ONESYSTEMCARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Onesystemcare tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/onesystemcare"
        date = "2026-10-16"
    strings:
        $attrib_str = "onesystemcare" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Onkfa0Sahzhg (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/onkfa0sahzhg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ONKFA0SAHZHG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Onkfa0Sahzhg (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/onkfa0sahzhg"
        date = "2026-10-16"
    strings:
        $fam_name = "onkfa0sahzhg" ascii wide nocase
        $alias_1 = "trojan.onkfa0sahzhg" ascii wide nocase
        $alias_2 = "win32/trojan.obfuscated" ascii wide nocase
        $alias_3 = "suspicious.dga" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ONKFA0SAHZHG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Onkfa0Sahzhg tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/onkfa0sahzhg"
        date = "2026-10-16"
    strings:
        $attrib_str = "onkfa0sahzhg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Onlineg (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/onlineg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ONLINEG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Onlineg (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/onlineg"
        date = "2026-10-16"
    strings:
        $fam_name = "onlineg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ONLINEG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Onlineg tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/onlineg"
        date = "2026-10-16"
    strings:
        $attrib_str = "onlineg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Opanki (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/opanki
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPANKI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Opanki (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opanki"
        date = "2026-10-16"
    strings:
        $fam_name = "opanki" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPANKI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Opanki tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opanki"
        date = "2026-10-16"
    strings:
        $attrib_str = "opanki" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Opencandy (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/opencandy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPENCANDY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Opencandy (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opencandy"
        date = "2026-10-16"
    strings:
        $fam_name = "opencandy" ascii wide nocase
        $alias_1 = "adware:win32/opencandy" ascii wide nocase
        $alias_2 = "pua:win32/candyopen" ascii wide nocase
        $alias_3 = "opencandy" ascii wide nocase
        $alias_4 = "adware.opencandy" ascii wide nocase
        $alias_5 = "win32/opencandy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPENCANDY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Opencandy tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opencandy"
        date = "2026-10-16"
    strings:
        $attrib_str = "opencandy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Opendownloadmanager (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/opendownloadmanager
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPENDOWNLOADMANAGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Opendownloadmanager (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opendownloadmanager"
        date = "2026-10-16"
    strings:
        $fam_name = "opendownloadmanager" ascii wide nocase
        $alias_1 = "pua:win32/opendownloadmanager" ascii wide nocase
        $alias_2 = "adware:win32/opendownloadmanager" ascii wide nocase
        $alias_3 = "program:win32/opendownloadmanager" ascii wide nocase
        $alias_4 = "opendownloadmanager adware" ascii wide nocase
        $alias_5 = "win32/opendownloadmanager" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPENDOWNLOADMANAGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Opendownloadmanager tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opendownloadmanager"
        date = "2026-10-16"
    strings:
        $attrib_str = "opendownloadmanager" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Openinstall (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/openinstall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPENINSTALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Openinstall (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/openinstall"
        date = "2026-10-16"
    strings:
        $fam_name = "openinstall" ascii wide nocase
        $alias_1 = "adware:win32/openinstall" ascii wide nocase
        $alias_2 = "pua:win32/openinstall" ascii wide nocase
        $alias_3 = "openinstall bundler" ascii wide nocase
        $alias_4 = "program:win32/openinstall" ascii wide nocase
        $alias_5 = "win32/openinstall" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPENINSTALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Openinstall tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/openinstall"
        date = "2026-10-16"
    strings:
        $attrib_str = "openinstall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Openshopper (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/openshopper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPENSHOPPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Openshopper (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/openshopper"
        date = "2026-10-16"
    strings:
        $fam_name = "openshopper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPENSHOPPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Openshopper tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/openshopper"
        date = "2026-10-16"
    strings:
        $attrib_str = "openshopper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Opensupdater (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/opensupdater
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPENSUPDATER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Opensupdater (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opensupdater"
        date = "2026-10-16"
    strings:
        $fam_name = "opensupdater" ascii wide nocase
        $alias_1 = "adware:win32/opensupdater" ascii wide nocase
        $alias_2 = "pua:win32/opensupdater" ascii wide nocase
        $alias_3 = "win32/opensupdater" ascii wide nocase
        $alias_4 = "opensoftwareupdater" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPENSUPDATER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Opensupdater tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opensupdater"
        date = "2026-10-16"
    strings:
        $attrib_str = "opensupdater" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Opesup (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/opesup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPESUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Opesup (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opesup"
        date = "2026-10-16"
    strings:
        $fam_name = "opesup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPESUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Opesup tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opesup"
        date = "2026-10-16"
    strings:
        $attrib_str = "opesup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Opriupdater (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/opriupdater
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPRIUPDATER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Opriupdater (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opriupdater"
        date = "2026-10-16"
    strings:
        $fam_name = "opriupdater" ascii wide nocase
        $alias_1 = "adware.opriupdater" ascii wide nocase
        $alias_2 = "pup.opriupdater" ascii wide nocase
        $alias_3 = "browsermodifier:win32/opriupdater" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPRIUPDATER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Opriupdater tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/opriupdater"
        date = "2026-10-16"
    strings:
        $attrib_str = "opriupdater" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Optimizer (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/optimizer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPTIMIZER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Optimizer (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/optimizer"
        date = "2026-10-16"
    strings:
        $fam_name = "optimizer" ascii wide nocase
        $alias_1 = "pua:win32/optimizer" ascii wide nocase
        $alias_2 = "program:win32/optimizer" ascii wide nocase
        $alias_3 = "rogue:win32/optimizer" ascii wide nocase
        $alias_4 = "optimizer utility" ascii wide nocase
        $alias_5 = "win32/optimizer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPTIMIZER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Optimizer tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/optimizer"
        date = "2026-10-16"
    strings:
        $attrib_str = "optimizer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Optispeed (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/optispeed
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPTISPEED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Optispeed (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/optispeed"
        date = "2026-10-16"
    strings:
        $fam_name = "optispeed" ascii wide nocase
        $alias_1 = "pup.optispeed" ascii wide nocase
        $alias_2 = "rogue.optispeed" ascii wide nocase
        $alias_3 = "win32/fakeoptimizer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPTISPEED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Optispeed tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/optispeed"
        date = "2026-10-16"
    strings:
        $attrib_str = "optispeed" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Optix (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/optix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OPTIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Optix (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/optix"
        date = "2026-10-16"
    strings:
        $fam_name = "optix" ascii wide nocase
        $alias_1 = "backdoor.optixpro" ascii wide nocase
        $alias_2 = "trojan.optix" ascii wide nocase
        $alias_3 = "win32/optix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OPTIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Optix tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/optix"
        date = "2026-10-16"
    strings:
        $attrib_str = "optix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Orangedefender (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/orangedefender
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ORANGEDEFENDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Orangedefender (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orangedefender"
        date = "2026-10-16"
    strings:
        $fam_name = "orangedefender" ascii wide nocase
        $alias_1 = "rogue.orangedefender" ascii wide nocase
        $alias_2 = "fakeav.orangedefender" ascii wide nocase
        $alias_3 = "trojan:win32/fakeav" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ORANGEDEFENDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Orangedefender tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orangedefender"
        date = "2026-10-16"
    strings:
        $attrib_str = "orangedefender" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Orbus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/orbus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ORBUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Orbus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orbus"
        date = "2026-10-16"
    strings:
        $fam_name = "orbus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ORBUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Orbus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orbus"
        date = "2026-10-16"
    strings:
        $attrib_str = "orbus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Orcus (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/orcus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ORCUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Orcus (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orcus"
        date = "2026-10-16"
    strings:
        $fam_name = "orcus" ascii wide nocase
        $alias_1 = "backdoor:win32/orcus" ascii wide nocase
        $alias_2 = "msil/orcus" ascii wide nocase
        $alias_3 = "orcus rat" ascii wide nocase
        $alias_4 = "trojan:msil/orcus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ORCUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Orcus tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orcus"
        date = "2026-10-16"
    strings:
        $attrib_str = "orcus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Orcusrat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/orcusrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ORCUSRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Orcusrat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orcusrat"
        date = "2026-10-16"
    strings:
        $fam_name = "orcusrat" ascii wide nocase
        $alias_1 = "rat.orcus" ascii wide nocase
        $alias_2 = "trojan.orcusrat" ascii wide nocase
        $alias_3 = "orcusremote" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ORCUSRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Orcusrat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orcusrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "orcusrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Orcusrot (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/orcusrot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ORCUSROT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Orcusrot (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orcusrot"
        date = "2026-10-16"
    strings:
        $fam_name = "orcusrot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ORCUSROT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Orcusrot tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orcusrot"
        date = "2026-10-16"
    strings:
        $attrib_str = "orcusrot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Oremu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oremu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OREMU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oremu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oremu"
        date = "2026-10-16"
    strings:
        $fam_name = "oremu" ascii wide nocase
        $alias_1 = "trojan.oremu" ascii wide nocase
        $alias_2 = "downloader.oremu" ascii wide nocase
        $alias_3 = "win32/oremu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OREMU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oremu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oremu"
        date = "2026-10-16"
    strings:
        $attrib_str = "oremu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Orsam (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/orsam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ORSAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Orsam (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orsam"
        date = "2026-10-16"
    strings:
        $fam_name = "orsam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ORSAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Orsam tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/orsam"
        date = "2026-10-16"
    strings:
        $attrib_str = "orsam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Otezinu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/otezinu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OTEZINU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Otezinu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/otezinu"
        date = "2026-10-16"
    strings:
        $fam_name = "otezinu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OTEZINU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Otezinu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/otezinu"
        date = "2026-10-16"
    strings:
        $attrib_str = "otezinu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Otorunq (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/otorunq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OTORUNQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Otorunq (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/otorunq"
        date = "2026-10-16"
    strings:
        $fam_name = "otorunq" ascii wide nocase
        $alias_1 = "worm.otorunq" ascii wide nocase
        $alias_2 = "autorun.otorunq" ascii wide nocase
        $alias_3 = "win32/otorunq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OTORUNQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Otorunq tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/otorunq"
        date = "2026-10-16"
    strings:
        $attrib_str = "otorunq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ou0Bsubcbkhb (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ou0bsubcbkhb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OU0BSUBCBKHB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ou0Bsubcbkhb (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ou0bsubcbkhb"
        date = "2026-10-16"
    strings:
        $fam_name = "ou0bsubcbkhb" ascii wide nocase
        $alias_1 = "generic.obfuscated" ascii wide nocase
        $alias_2 = "suspicious.ou0bsubcbkhb" ascii wide nocase
        $alias_3 = "heur.ou0bsubcbkhb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OU0BSUBCBKHB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ou0Bsubcbkhb tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ou0bsubcbkhb"
        date = "2026-10-16"
    strings:
        $attrib_str = "ou0bsubcbkhb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Outbreak (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/outbreak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OUTBREAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Outbreak (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/outbreak"
        date = "2026-10-16"
    strings:
        $fam_name = "outbreak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OUTBREAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Outbreak tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/outbreak"
        date = "2026-10-16"
    strings:
        $attrib_str = "outbreak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Outbrowse (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/outbrowse
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OUTBROWSE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Outbrowse (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/outbrowse"
        date = "2026-10-16"
    strings:
        $fam_name = "outbrowse" ascii wide nocase
        $alias_1 = "softwarebundler:win32/outbrowse" ascii wide nocase
        $alias_2 = "pua:win32/outbrowse" ascii wide nocase
        $alias_3 = "pup.optional.outbrowse" ascii wide nocase
        $alias_4 = "win32/outbrowse" ascii wide nocase
        $alias_5 = "adware.outbrowse" ascii wide nocase
        $alias_6 = "softwarebundler:win32/outbrowse.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OUTBROWSE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Outbrowse tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/outbrowse"
        date = "2026-10-16"
    strings:
        $attrib_str = "outbrowse" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Oxynoxy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oxynoxy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OXYNOXY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oxynoxy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oxynoxy"
        date = "2026-10-16"
    strings:
        $fam_name = "oxynoxy" ascii wide nocase
        $alias_1 = "trojan.oxynoxy" ascii wide nocase
        $alias_2 = "downloader.oxynoxy" ascii wide nocase
        $alias_3 = "win32/oxynoxy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OXYNOXY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oxynoxy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oxynoxy"
        date = "2026-10-16"
    strings:
        $attrib_str = "oxynoxy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Oxypumper (Pua_Tool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oxypumper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OXYPUMPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oxypumper (Pua_Tool)"
        category = "Pua_Tool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oxypumper"
        date = "2026-10-16"
    strings:
        $fam_name = "oxypumper" ascii wide nocase
        $alias_1 = "virtool:win32/oxypumper" ascii wide nocase
        $alias_2 = "tool:win32/oxypumper" ascii wide nocase
        $alias_3 = "hacktool:win32/oxypumper" ascii wide nocase
        $alias_4 = "win32/oxypumper" ascii wide nocase
        $alias_5 = "oxyfilepumper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OXYPUMPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oxypumper tradecraft"
        category = "Pua_Tool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oxypumper"
        date = "2026-10-16"
    strings:
        $attrib_str = "oxypumper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Oyom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oyom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OYOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oyom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oyom"
        date = "2026-10-16"
    strings:
        $fam_name = "oyom" ascii wide nocase
        $alias_1 = "trojan.oyom" ascii wide nocase
        $alias_2 = "downloader.oyom" ascii wide nocase
        $alias_3 = "win32/oyom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OYOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oyom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oyom"
        date = "2026-10-16"
    strings:
        $attrib_str = "oyom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Oztar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/oztar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_OZTAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Oztar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oztar"
        date = "2026-10-16"
    strings:
        $fam_name = "oztar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_OZTAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Oztar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/oztar"
        date = "2026-10-16"
    strings:
        $attrib_str = "oztar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for P2Pworm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/p2pworm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_P2PWORM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for P2Pworm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/p2pworm"
        date = "2026-10-16"
    strings:
        $fam_name = "p2pworm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_P2PWORM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for P2Pworm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/p2pworm"
        date = "2026-10-16"
    strings:
        $attrib_str = "p2pworm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pabin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pabin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PABIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pabin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pabin"
        date = "2026-10-16"
    strings:
        $fam_name = "pabin" ascii wide nocase
        $alias_1 = "trojan.pabin" ascii wide nocase
        $alias_2 = "downloader.pabin" ascii wide nocase
        $alias_3 = "win32/pabin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PABIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pabin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pabin"
        date = "2026-10-16"
    strings:
        $attrib_str = "pabin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pacex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pacex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PACEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pacex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pacex"
        date = "2026-10-16"
    strings:
        $fam_name = "pacex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PACEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pacex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pacex"
        date = "2026-10-16"
    strings:
        $attrib_str = "pacex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Packedent (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/packedent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PACKEDENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Packedent (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/packedent"
        date = "2026-10-16"
    strings:
        $fam_name = "packedent" ascii wide nocase
        $alias_1 = "virtool:win32/packedent" ascii wide nocase
        $alias_2 = "packer:win32/packedent" ascii wide nocase
        $alias_3 = "trojan.win32.packedent" ascii wide nocase
        $alias_4 = "win32/packedent" ascii wide nocase
        $alias_5 = "virtool.win32.packedent.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PACKEDENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Packedent tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/packedent"
        date = "2026-10-16"
    strings:
        $attrib_str = "packedent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Packy (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/packy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PACKY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Packy (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/packy"
        date = "2026-10-16"
    strings:
        $fam_name = "packy" ascii wide nocase
        $alias_1 = "virtool:win32/packy" ascii wide nocase
        $alias_2 = "packer:win32/packy" ascii wide nocase
        $alias_3 = "trojan:win32/packy" ascii wide nocase
        $alias_4 = "win32/packy" ascii wide nocase
        $alias_5 = "virtool.win32.packy.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PACKY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Packy tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/packy"
        date = "2026-10-16"
    strings:
        $attrib_str = "packy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Padmer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/padmer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PADMER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Padmer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/padmer"
        date = "2026-10-16"
    strings:
        $fam_name = "padmer" ascii wide nocase
        $alias_1 = "trojan.padmer" ascii wide nocase
        $alias_2 = "downloader.padmer" ascii wide nocase
        $alias_3 = "win32/padmer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PADMER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Padmer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/padmer"
        date = "2026-10-16"
    strings:
        $attrib_str = "padmer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pajetbin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pajetbin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PAJETBIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pajetbin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pajetbin"
        date = "2026-10-16"
    strings:
        $fam_name = "pajetbin" ascii wide nocase
        $alias_1 = "ransom:win32/pajetbin" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.pajetbin" ascii wide nocase
        $alias_3 = "win32/pajetbin" ascii wide nocase
        $alias_4 = "ransom.pajetbin" ascii wide nocase
        $alias_5 = "ransom:win32/pajetbin.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PAJETBIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pajetbin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pajetbin"
        date = "2026-10-16"
    strings:
        $attrib_str = "pajetbin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pakes (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pakes
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PAKES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pakes (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pakes"
        date = "2026-10-16"
    strings:
        $fam_name = "pakes" ascii wide nocase
        $alias_1 = "virtool:win32/pakes" ascii wide nocase
        $alias_2 = "trojan:win32/pakes" ascii wide nocase
        $alias_3 = "packer.win32.pakes" ascii wide nocase
        $alias_4 = "win32/pakes" ascii wide nocase
        $alias_5 = "virtool.win32.pakes.a" ascii wide nocase
        $alias_6 = "trojan.win32.pakes" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PAKES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pakes tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pakes"
        date = "2026-10-16"
    strings:
        $attrib_str = "pakes" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Palevo (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/palevo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PALEVO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Palevo (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/palevo"
        date = "2026-10-16"
    strings:
        $fam_name = "palevo" ascii wide nocase
        $alias_1 = "palevo" ascii wide nocase
        $alias_2 = "worm:win32/palevo" ascii wide nocase
        $alias_3 = "butterfly bot" ascii wide nocase
        $alias_4 = "mariposa" ascii wide nocase
        $alias_5 = "rkit.palevo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PALEVO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Palevo tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/palevo"
        date = "2026-10-16"
    strings:
        $attrib_str = "palevo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Palibu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/palibu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PALIBU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Palibu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/palibu"
        date = "2026-10-16"
    strings:
        $fam_name = "palibu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PALIBU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Palibu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/palibu"
        date = "2026-10-16"
    strings:
        $attrib_str = "palibu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pandex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pandex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PANDEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pandex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pandex"
        date = "2026-10-16"
    strings:
        $fam_name = "pandex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PANDEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pandex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pandex"
        date = "2026-10-16"
    strings:
        $attrib_str = "pandex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pandview (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pandview
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PANDVIEW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pandview (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pandview"
        date = "2026-10-16"
    strings:
        $fam_name = "pandview" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PANDVIEW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pandview tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pandview"
        date = "2026-10-16"
    strings:
        $attrib_str = "pandview" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pantera (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pantera
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PANTERA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pantera (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pantera"
        date = "2026-10-16"
    strings:
        $fam_name = "pantera" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PANTERA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pantera tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pantera"
        date = "2026-10-16"
    strings:
        $attrib_str = "pantera" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Paper (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/paper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PAPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Paper (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/paper"
        date = "2026-10-16"
    strings:
        $fam_name = "paper" ascii wide nocase
        $alias_1 = "adware.paper" ascii wide nocase
        $alias_2 = "pup.paper" ascii wide nocase
        $alias_3 = "browsermodifier.paper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PAPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Paper tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/paper"
        date = "2026-10-16"
    strings:
        $attrib_str = "paper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Paph (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/paph
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PAPH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Paph (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/paph"
        date = "2026-10-16"
    strings:
        $fam_name = "paph" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PAPH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Paph tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/paph"
        date = "2026-10-16"
    strings:
        $attrib_str = "paph" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Papras (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/papras
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PAPRAS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Papras (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/papras"
        date = "2026-10-16"
    strings:
        $fam_name = "papras" ascii wide nocase
        $alias_1 = "trojan:win32/papras" ascii wide nocase
        $alias_2 = "pws:win32/papras" ascii wide nocase
        $alias_3 = "trojan-psw.win32.papras" ascii wide nocase
        $alias_4 = "win32/papras" ascii wide nocase
        $alias_5 = "papras stealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PAPRAS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Papras tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/papras"
        date = "2026-10-16"
    strings:
        $attrib_str = "papras" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Paradise (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/paradise
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PARADISE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Paradise (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/paradise"
        date = "2026-10-16"
    strings:
        $fam_name = "paradise" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PARADISE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Paradise tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/paradise"
        date = "2026-10-16"
    strings:
        $attrib_str = "paradise" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Parite (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/parite
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PARITE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Parite (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/parite"
        date = "2026-10-16"
    strings:
        $fam_name = "parite" ascii wide nocase
        $alias_1 = "virus:win32/parite.b" ascii wide nocase
        $alias_2 = "virus:win32/parite.a" ascii wide nocase
        $alias_3 = "virus.win32.parite.b" ascii wide nocase
        $alias_4 = "pinfi" ascii wide nocase
        $alias_5 = "pe_parite.a" ascii wide nocase
        $alias_6 = "w32.pinite" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PARITE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Parite tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/parite"
        date = "2026-10-16"
    strings:
        $attrib_str = "parite" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Passcrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/passcrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PASSCRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Passcrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passcrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "passcrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PASSCRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Passcrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passcrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "passcrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Passcv (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/passcv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PASSCV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Passcv (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passcv"
        date = "2026-10-16"
    strings:
        $fam_name = "passcv" ascii wide nocase
        $alias_1 = "trojan.passcv" ascii wide nocase
        $alias_2 = "passwordstealer.passcv" ascii wide nocase
        $alias_3 = "win32/passcv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PASSCV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Passcv tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passcv"
        date = "2026-10-16"
    strings:
        $attrib_str = "passcv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Passma (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/passma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PASSMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Passma (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passma"
        date = "2026-10-16"
    strings:
        $fam_name = "passma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PASSMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Passma tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passma"
        date = "2026-10-16"
    strings:
        $attrib_str = "passma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Passview (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/passview
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PASSVIEW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Passview (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passview"
        date = "2026-10-16"
    strings:
        $fam_name = "passview" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PASSVIEW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Passview tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passview"
        date = "2026-10-16"
    strings:
        $attrib_str = "passview" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Passwordfox (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/passwordfox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PASSWORDFOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Passwordfox (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passwordfox"
        date = "2026-10-16"
    strings:
        $fam_name = "passwordfox" ascii wide nocase
        $alias_1 = "hacktool.passwordfox" ascii wide nocase
        $alias_2 = "riskware.passwordviewer" ascii wide nocase
        $alias_3 = "pws.nirsoft" ascii wide nocase
        $alias_4 = "tool.passwordfox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PASSWORDFOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Passwordfox tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passwordfox"
        date = "2026-10-16"
    strings:
        $attrib_str = "passwordfox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Passwordstealer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/passwordstealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PASSWORDSTEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Passwordstealer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passwordstealer"
        date = "2026-10-16"
    strings:
        $fam_name = "passwordstealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PASSWORDSTEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Passwordstealer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/passwordstealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "passwordstealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pasta (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pasta
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PASTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pasta (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pasta"
        date = "2026-10-16"
    strings:
        $fam_name = "pasta" ascii wide nocase
        $alias_1 = "ransom:win32/pasta" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.pasta" ascii wide nocase
        $alias_3 = "win32/pasta" ascii wide nocase
        $alias_4 = "ransom.pasta" ascii wide nocase
        $alias_5 = "ransom:win32/pasta.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PASTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pasta tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pasta"
        date = "2026-10-16"
    strings:
        $attrib_str = "pasta" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pastraw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pastraw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PASTRAW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pastraw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pastraw"
        date = "2026-10-16"
    strings:
        $fam_name = "pastraw" ascii wide nocase
        $alias_1 = "trojan.pastraw" ascii wide nocase
        $alias_2 = "downloader.pastraw" ascii wide nocase
        $alias_3 = "win32/pastraw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PASTRAW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pastraw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pastraw"
        date = "2026-10-16"
    strings:
        $attrib_str = "pastraw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pasur (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pasur
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PASUR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pasur (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pasur"
        date = "2026-10-16"
    strings:
        $fam_name = "pasur" ascii wide nocase
        $alias_1 = "trojan.pasur" ascii wide nocase
        $alias_2 = "downloader.pasur" ascii wide nocase
        $alias_3 = "win32/pasur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PASUR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pasur tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pasur"
        date = "2026-10-16"
    strings:
        $attrib_str = "pasur" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Patch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/patch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PATCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Patch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/patch"
        date = "2026-10-16"
    strings:
        $fam_name = "patch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PATCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Patch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/patch"
        date = "2026-10-16"
    strings:
        $attrib_str = "patch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Patchload (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/patchload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PATCHLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Patchload (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/patchload"
        date = "2026-10-16"
    strings:
        $fam_name = "patchload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PATCHLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Patchload tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/patchload"
        date = "2026-10-16"
    strings:
        $attrib_str = "patchload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Patchupplus (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/patchupplus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PATCHUPPLUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Patchupplus (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/patchupplus"
        date = "2026-10-16"
    strings:
        $fam_name = "patchupplus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PATCHUPPLUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Patchupplus tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/patchupplus"
        date = "2026-10-16"
    strings:
        $attrib_str = "patchupplus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Patpoopy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/patpoopy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PATPOOPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Patpoopy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/patpoopy"
        date = "2026-10-16"
    strings:
        $fam_name = "patpoopy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PATPOOPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Patpoopy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/patpoopy"
        date = "2026-10-16"
    strings:
        $attrib_str = "patpoopy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pavica (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pavica
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PAVICA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pavica (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pavica"
        date = "2026-10-16"
    strings:
        $fam_name = "pavica" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PAVICA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pavica tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pavica"
        date = "2026-10-16"
    strings:
        $attrib_str = "pavica" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Payer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/payer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PAYER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Payer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/payer"
        date = "2026-10-16"
    strings:
        $fam_name = "payer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PAYER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Payer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/payer"
        date = "2026-10-16"
    strings:
        $attrib_str = "payer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pbot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pbot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pbot"
        date = "2026-10-16"
    strings:
        $fam_name = "pbot" ascii wide nocase
        $alias_1 = "backdoor:win32/pbot" ascii wide nocase
        $alias_2 = "trojan:win32/pbot" ascii wide nocase
        $alias_3 = "win32/pbot" ascii wide nocase
        $alias_4 = "backdoor.pbot" ascii wide nocase
        $alias_5 = "trojan.pbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pbot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "pbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pcacceleratepro (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcacceleratepro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCACCELERATEPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcacceleratepro (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcacceleratepro"
        date = "2026-10-16"
    strings:
        $fam_name = "pcacceleratepro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCACCELERATEPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcacceleratepro tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcacceleratepro"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcacceleratepro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pcbooster (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcbooster
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCBOOSTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcbooster (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcbooster"
        date = "2026-10-16"
    strings:
        $fam_name = "pcbooster" ascii wide nocase
        $alias_1 = "rogue.pcbooster" ascii wide nocase
        $alias_2 = "pup.fakeoptimizer" ascii wide nocase
        $alias_3 = "scareware.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCBOOSTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcbooster tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcbooster"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcbooster" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pcclean (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcclean
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCCLEAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcclean (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcclean"
        date = "2026-10-16"
    strings:
        $fam_name = "pcclean" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCCLEAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcclean tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcclean"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcclean" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pccleaner (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pccleaner
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCCLEANER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pccleaner (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pccleaner"
        date = "2026-10-16"
    strings:
        $fam_name = "pccleaner" ascii wide nocase
        $alias_1 = "pua:win32/pccleaner" ascii wide nocase
        $alias_2 = "program:win32/pccleaner" ascii wide nocase
        $alias_3 = "rogue:win32/pccleaner" ascii wide nocase
        $alias_4 = "win32/pccleaner" ascii wide nocase
        $alias_5 = "pc cleaner pro rogue" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCCLEANER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pccleaner tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pccleaner"
        date = "2026-10-16"
    strings:
        $attrib_str = "pccleaner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pccleaners (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pccleaners
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCCLEANERS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pccleaners (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pccleaners"
        date = "2026-10-16"
    strings:
        $fam_name = "pccleaners" ascii wide nocase
        $alias_1 = "rogue.pccleaners" ascii wide nocase
        $alias_2 = "pup.fakeoptimizer" ascii wide nocase
        $alias_3 = "scareware.pcclean" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCCLEANERS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pccleaners tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pccleaners"
        date = "2026-10-16"
    strings:
        $attrib_str = "pccleaners" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pccleaningutility (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pccleaningutility
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCCLEANINGUTILITY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pccleaningutility (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pccleaningutility"
        date = "2026-10-16"
    strings:
        $fam_name = "pccleaningutility" ascii wide nocase
        $alias_1 = "rogue.pccleaningutility" ascii wide nocase
        $alias_2 = "pup.fakeoptimizer" ascii wide nocase
        $alias_3 = "scareware.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCCLEANINGUTILITY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pccleaningutility tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pccleaningutility"
        date = "2026-10-16"
    strings:
        $attrib_str = "pccleaningutility" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pccleanplus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pccleanplus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCCLEANPLUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pccleanplus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pccleanplus"
        date = "2026-10-16"
    strings:
        $fam_name = "pccleanplus" ascii wide nocase
        $alias_1 = "rogue.pccleanplus" ascii wide nocase
        $alias_2 = "pup.fakeoptimizer" ascii wide nocase
        $alias_3 = "scareware.pcclean" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCCLEANPLUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pccleanplus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pccleanplus"
        date = "2026-10-16"
    strings:
        $attrib_str = "pccleanplus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pccleanup (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pccleanup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCCLEANUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pccleanup (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pccleanup"
        date = "2026-10-16"
    strings:
        $fam_name = "pccleanup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCCLEANUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pccleanup tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pccleanup"
        date = "2026-10-16"
    strings:
        $attrib_str = "pccleanup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pcclient (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcclient
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCCLIENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcclient (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcclient"
        date = "2026-10-16"
    strings:
        $fam_name = "pcclient" ascii wide nocase
        $alias_1 = "backdoor:win32/pcclient" ascii wide nocase
        $alias_2 = "trojan:win32/pcclient" ascii wide nocase
        $alias_3 = "backdoor.win32.pcclient" ascii wide nocase
        $alias_4 = "win32/pcclient" ascii wide nocase
        $alias_5 = "pcshare rat" ascii wide nocase
        $alias_6 = "backdoor.pcclient" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCCLIENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcclient tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcclient"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcclient" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Pcfixer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcfixer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCFIXER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcfixer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcfixer"
        date = "2026-10-16"
    strings:
        $fam_name = "pcfixer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCFIXER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcfixer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcfixer"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcfixer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pchealthboost (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pchealthboost
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCHEALTHBOOST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pchealthboost (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pchealthboost"
        date = "2026-10-16"
    strings:
        $fam_name = "pchealthboost" ascii wide nocase
        $alias_1 = "rogue.pchealthboost" ascii wide nocase
        $alias_2 = "pup.fakeoptimizer" ascii wide nocase
        $alias_3 = "scareware.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCHEALTHBOOST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pchealthboost tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pchealthboost"
        date = "2026-10-16"
    strings:
        $attrib_str = "pchealthboost" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pckdflystudio (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pckdflystudio
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCKDFLYSTUDIO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pckdflystudio (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pckdflystudio"
        date = "2026-10-16"
    strings:
        $fam_name = "pckdflystudio" ascii wide nocase
        $alias_1 = "packer.flystudio" ascii wide nocase
        $alias_2 = "suspicious.packed" ascii wide nocase
        $alias_3 = "win32/packed.flystudio" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCKDFLYSTUDIO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pckdflystudio tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pckdflystudio"
        date = "2026-10-16"
    strings:
        $attrib_str = "pckdflystudio" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pckeeper (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pckeeper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCKEEPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pckeeper (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pckeeper"
        date = "2026-10-16"
    strings:
        $fam_name = "pckeeper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCKEEPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pckeeper tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pckeeper"
        date = "2026-10-16"
    strings:
        $attrib_str = "pckeeper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pclnt (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pclnt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCLNT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pclnt (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pclnt"
        date = "2026-10-16"
    strings:
        $fam_name = "pclnt" ascii wide nocase
        $alias_1 = "backdoor.pclnt" ascii wide nocase
        $alias_2 = "trojan.pclnt" ascii wide nocase
        $alias_3 = "win32/pclnt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCLNT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pclnt tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pclnt"
        date = "2026-10-16"
    strings:
        $attrib_str = "pclnt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pcmechanic (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcmechanic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCMECHANIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcmechanic (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcmechanic"
        date = "2026-10-16"
    strings:
        $fam_name = "pcmechanic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCMECHANIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcmechanic tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcmechanic"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcmechanic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pcmedic (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcmedic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCMEDIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcmedic (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcmedic"
        date = "2026-10-16"
    strings:
        $fam_name = "pcmedic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCMEDIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcmedic tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcmedic"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcmedic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pcmega (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcmega
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCMEGA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcmega (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcmega"
        date = "2026-10-16"
    strings:
        $fam_name = "pcmega" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCMEGA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcmega tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcmega"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcmega" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pcopticlean (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcopticlean
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCOPTICLEAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcopticlean (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcopticlean"
        date = "2026-10-16"
    strings:
        $fam_name = "pcopticlean" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCOPTICLEAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcopticlean tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcopticlean"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcopticlean" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pcoptimizerpro (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcoptimizerpro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCOPTIMIZERPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcoptimizerpro (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcoptimizerpro"
        date = "2026-10-16"
    strings:
        $fam_name = "pcoptimizerpro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCOPTIMIZERPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcoptimizerpro tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcoptimizerpro"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcoptimizerpro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pcrepair (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcrepair
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCREPAIR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcrepair (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcrepair"
        date = "2026-10-16"
    strings:
        $fam_name = "pcrepair" ascii wide nocase
        $alias_1 = "rogue.pcrepair" ascii wide nocase
        $alias_2 = "scareware.pcrepair" ascii wide nocase
        $alias_3 = "win32/fakeav" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCREPAIR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcrepair tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcrepair"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcrepair" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pcreviver (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcreviver
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCREVIVER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcreviver (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcreviver"
        date = "2026-10-16"
    strings:
        $fam_name = "pcreviver" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCREVIVER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcreviver tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcreviver"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcreviver" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pcvark (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pcvark
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PCVARK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pcvark (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcvark"
        date = "2026-10-16"
    strings:
        $fam_name = "pcvark" ascii wide nocase
        $alias_1 = "pup.pcvark" ascii wide nocase
        $alias_2 = "rogue.systemoptimizer" ascii wide nocase
        $alias_3 = "scareware.maccleaner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PCVARK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pcvark tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pcvark"
        date = "2026-10-16"
    strings:
        $attrib_str = "pcvark" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pdxbbkgat9Ci (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pdxbbkgat9ci
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PDXBBKGAT9CI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pdxbbkgat9Ci (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pdxbbkgat9ci"
        date = "2026-10-16"
    strings:
        $fam_name = "pdxbbkgat9ci" ascii wide nocase
        $alias_1 = "trojan.pdxbbkgat9ci" ascii wide nocase
        $alias_2 = "win32/trojan.obfuscated" ascii wide nocase
        $alias_3 = "suspicious.dga" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PDXBBKGAT9CI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pdxbbkgat9Ci tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pdxbbkgat9ci"
        date = "2026-10-16"
    strings:
        $attrib_str = "pdxbbkgat9ci" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Peals (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/peals
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PEALS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Peals (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/peals"
        date = "2026-10-16"
    strings:
        $fam_name = "peals" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PEALS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Peals tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/peals"
        date = "2026-10-16"
    strings:
        $attrib_str = "peals" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pedex (Crypter)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pedex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PEDEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pedex (Crypter)"
        category = "Crypter"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pedex"
        date = "2026-10-16"
    strings:
        $fam_name = "pedex" ascii wide nocase
        $alias_1 = "virtool:win32/pedex" ascii wide nocase
        $alias_2 = "trojan:win32/pedex" ascii wide nocase
        $alias_3 = "trojan.pedex" ascii wide nocase
        $alias_4 = "win32/pedex" ascii wide nocase
        $alias_5 = "virtool:win32/pedex.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PEDEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pedex tradecraft"
        category = "Crypter"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pedex"
        date = "2026-10-16"
    strings:
        $attrib_str = "pedex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Peed (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/peed
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PEED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Peed (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/peed"
        date = "2026-10-16"
    strings:
        $fam_name = "peed" ascii wide nocase
        $alias_1 = "trojan.peacomm" ascii wide nocase
        $alias_2 = "worm.storm" ascii wide nocase
        $alias_3 = "win32/peed" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PEED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Peed tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/peed"
        date = "2026-10-16"
    strings:
        $attrib_str = "peed" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Peepviewer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/peepviewer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PEEPVIEWER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Peepviewer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/peepviewer"
        date = "2026-10-16"
    strings:
        $fam_name = "peepviewer" ascii wide nocase
        $alias_1 = "hacktool.peepviewer" ascii wide nocase
        $alias_2 = "spyware.vnc" ascii wide nocase
        $alias_3 = "backdoor.stealthvnc" ascii wide nocase
        $alias_4 = "tool.remoteadmin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PEEPVIEWER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Peepviewer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/peepviewer"
        date = "2026-10-16"
    strings:
        $attrib_str = "peepviewer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pef13C (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pef13c
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PEF13C_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pef13C (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pef13c"
        date = "2026-10-16"
    strings:
        $fam_name = "pef13c" ascii wide nocase
        $alias_1 = "trojan.generic.pef13c" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PEF13C_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pef13C tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pef13c"
        date = "2026-10-16"
    strings:
        $attrib_str = "pef13c" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Peflog (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/peflog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PEFLOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Peflog (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/peflog"
        date = "2026-10-16"
    strings:
        $fam_name = "peflog" ascii wide nocase
        $alias_1 = "trojan.peflog" ascii wide nocase
        $alias_2 = "pws.peflog" ascii wide nocase
        $alias_3 = "trojanspy.peflog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PEFLOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Peflog tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/peflog"
        date = "2026-10-16"
    strings:
        $attrib_str = "peflog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pennybee (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pennybee
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PENNYBEE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pennybee (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pennybee"
        date = "2026-10-16"
    strings:
        $fam_name = "pennybee" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PENNYBEE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pennybee tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pennybee"
        date = "2026-10-16"
    strings:
        $attrib_str = "pennybee" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Penzievs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/penzievs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PENZIEVS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Penzievs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/penzievs"
        date = "2026-10-16"
    strings:
        $fam_name = "penzievs" ascii wide nocase
        $alias_1 = "trojan.penzievs" ascii wide nocase
        $alias_2 = "backdoor.penzievs" ascii wide nocase
        $alias_3 = "win32/penzievs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PENZIEVS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Penzievs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/penzievs"
        date = "2026-10-16"
    strings:
        $attrib_str = "penzievs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pepex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pepex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PEPEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pepex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pepex"
        date = "2026-10-16"
    strings:
        $fam_name = "pepex" ascii wide nocase
        $alias_1 = "trojan.pepex" ascii wide nocase
        $alias_2 = "downloader.pepex" ascii wide nocase
        $alias_3 = "win32/pepex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PEPEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pepex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pepex"
        date = "2026-10-16"
    strings:
        $attrib_str = "pepex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pepm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pepm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PEPM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pepm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pepm"
        date = "2026-10-16"
    strings:
        $fam_name = "pepm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PEPM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pepm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pepm"
        date = "2026-10-16"
    strings:
        $attrib_str = "pepm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Perez (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/perez
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PEREZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Perez (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perez"
        date = "2026-10-16"
    strings:
        $fam_name = "perez" ascii wide nocase
        $alias_1 = "trojan.perez" ascii wide nocase
        $alias_2 = "downloader.perez" ascii wide nocase
        $alias_3 = "win32/perez" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PEREZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Perez tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perez"
        date = "2026-10-16"
    strings:
        $attrib_str = "perez" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Perfectoptimizer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/perfectoptimizer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PERFECTOPTIMIZER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Perfectoptimizer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perfectoptimizer"
        date = "2026-10-16"
    strings:
        $fam_name = "perfectoptimizer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PERFECTOPTIMIZER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Perfectoptimizer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perfectoptimizer"
        date = "2026-10-16"
    strings:
        $attrib_str = "perfectoptimizer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Perflogger (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/perflogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PERFLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Perflogger (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perflogger"
        date = "2026-10-16"
    strings:
        $fam_name = "perflogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PERFLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Perflogger tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perflogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "perflogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Perinet (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/perinet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PERINET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Perinet (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perinet"
        date = "2026-10-16"
    strings:
        $fam_name = "perinet" ascii wide nocase
        $alias_1 = "worm:win32/perinet" ascii wide nocase
        $alias_2 = "backdoor:win32/perinet" ascii wide nocase
        $alias_3 = "trojan.perinet" ascii wide nocase
        $alias_4 = "win32/perinet" ascii wide nocase
        $alias_5 = "perinet worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PERINET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Perinet tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perinet"
        date = "2026-10-16"
    strings:
        $attrib_str = "perinet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Perion (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/perion
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PERION_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Perion (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perion"
        date = "2026-10-16"
    strings:
        $fam_name = "perion" ascii wide nocase
        $alias_1 = "browsermodifier:win32/perion" ascii wide nocase
        $alias_2 = "adware:win32/perion" ascii wide nocase
        $alias_3 = "pua:win32/perion" ascii wide nocase
        $alias_4 = "perion network adware" ascii wide nocase
        $alias_5 = "sweetpacks perion" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PERION_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Perion tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perion"
        date = "2026-10-16"
    strings:
        $attrib_str = "perion" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Perkesh (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/perkesh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PERKESH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Perkesh (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perkesh"
        date = "2026-10-16"
    strings:
        $fam_name = "perkesh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PERKESH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Perkesh tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perkesh"
        date = "2026-10-16"
    strings:
        $attrib_str = "perkesh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Perkiler (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/perkiler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PERKILER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Perkiler (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perkiler"
        date = "2026-10-16"
    strings:
        $fam_name = "perkiler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PERKILER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Perkiler tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perkiler"
        date = "2026-10-16"
    strings:
        $attrib_str = "perkiler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Perseus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/perseus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PERSEUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Perseus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perseus"
        date = "2026-10-16"
    strings:
        $fam_name = "perseus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PERSEUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Perseus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/perseus"
        date = "2026-10-16"
    strings:
        $attrib_str = "perseus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pespin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pespin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PESPIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pespin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pespin"
        date = "2026-10-16"
    strings:
        $fam_name = "pespin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PESPIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pespin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pespin"
        date = "2026-10-16"
    strings:
        $attrib_str = "pespin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Petal (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/petal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PETAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Petal (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/petal"
        date = "2026-10-16"
    strings:
        $fam_name = "petal" ascii wide nocase
        $alias_1 = "trojan.petal" ascii wide nocase
        $alias_2 = "downloader.petal" ascii wide nocase
        $alias_3 = "win32/petal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PETAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Petal tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/petal"
        date = "2026-10-16"
    strings:
        $attrib_str = "petal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Petun (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/petun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PETUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Petun (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/petun"
        date = "2026-10-16"
    strings:
        $fam_name = "petun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PETUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Petun tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/petun"
        date = "2026-10-16"
    strings:
        $attrib_str = "petun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Petya (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/petya
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PETYA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Petya (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/petya"
        date = "2026-10-16"
    strings:
        $fam_name = "petya" ascii wide nocase
        $alias_1 = "petya" ascii wide nocase
        $alias_2 = "notpetya" ascii wide nocase
        $alias_3 = "nyetya" ascii wide nocase
        $alias_4 = "goldeneye" ascii wide nocase
        $alias_5 = "petrwrap" ascii wide nocase
        $alias_6 = "expetr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PETYA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Petya tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/petya"
        date = "2026-10-16"
    strings:
        $attrib_str = "petya" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pfoenic (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pfoenic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PFOENIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pfoenic (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pfoenic"
        date = "2026-10-16"
    strings:
        $fam_name = "pfoenic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PFOENIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pfoenic tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pfoenic"
        date = "2026-10-16"
    strings:
        $attrib_str = "pfoenic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pgpsnippet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pgpsnippet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PGPSNIPPET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pgpsnippet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pgpsnippet"
        date = "2026-10-16"
    strings:
        $fam_name = "pgpsnippet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PGPSNIPPET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pgpsnippet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pgpsnippet"
        date = "2026-10-16"
    strings:
        $attrib_str = "pgpsnippet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Phires (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/phires
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PHIRES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Phires (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phires"
        date = "2026-10-16"
    strings:
        $fam_name = "phires" ascii wide nocase
        $alias_1 = "trojan.phires" ascii wide nocase
        $alias_2 = "downloader.phires" ascii wide nocase
        $alias_3 = "win32/phires" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PHIRES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Phires tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phires"
        date = "2026-10-16"
    strings:
        $attrib_str = "phires" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Phnu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/phnu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PHNU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Phnu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phnu"
        date = "2026-10-16"
    strings:
        $fam_name = "phnu" ascii wide nocase
        $alias_1 = "trojan.phnu" ascii wide nocase
        $alias_2 = "downloader.phnu" ascii wide nocase
        $alias_3 = "win32/phnu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PHNU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Phnu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phnu"
        date = "2026-10-16"
    strings:
        $attrib_str = "phnu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Phny (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/phny
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PHNY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Phny (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phny"
        date = "2026-10-16"
    strings:
        $fam_name = "phny" ascii wide nocase
        $alias_1 = "ransom:win32/phny" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.phny" ascii wide nocase
        $alias_3 = "trojan.phny" ascii wide nocase
        $alias_4 = "win32/phny" ascii wide nocase
        $alias_5 = "ransom:win32/phny.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PHNY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Phny tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phny"
        date = "2026-10-16"
    strings:
        $attrib_str = "phny" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Phonerooter (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/phonerooter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PHONEROOTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Phonerooter (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phonerooter"
        date = "2026-10-16"
    strings:
        $fam_name = "phonerooter" ascii wide nocase
        $alias_1 = "hacktool.androidroot" ascii wide nocase
        $alias_2 = "exploit.android.rooter" ascii wide nocase
        $alias_3 = "tool.kingoroot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PHONEROOTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Phonerooter tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phonerooter"
        date = "2026-10-16"
    strings:
        $attrib_str = "phonerooter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Phorpiex (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/phorpiex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PHORPIEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Phorpiex (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phorpiex"
        date = "2026-10-16"
    strings:
        $fam_name = "phorpiex" ascii wide nocase
        $alias_1 = "worm:win32/phorpiex" ascii wide nocase
        $alias_2 = "trojan:win32/phorpiex" ascii wide nocase
        $alias_3 = "worm.win32.trik" ascii wide nocase
        $alias_4 = "trik botnet" ascii wide nocase
        $alias_5 = "win32/phorpiex" ascii wide nocase
        $alias_6 = "phorpiex botnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PHORPIEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Phorpiex tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phorpiex"
        date = "2026-10-16"
    strings:
        $attrib_str = "phorpiex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Phpain (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/phpain
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PHPAIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Phpain (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phpain"
        date = "2026-10-16"
    strings:
        $fam_name = "phpain" ascii wide nocase
        $alias_1 = "trojan.phpain" ascii wide nocase
        $alias_2 = "downloader.phpain" ascii wide nocase
        $alias_3 = "win32/phpain" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PHPAIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Phpain tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phpain"
        date = "2026-10-16"
    strings:
        $attrib_str = "phpain" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Phpw (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/phpw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PHPW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Phpw (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phpw"
        date = "2026-10-16"
    strings:
        $fam_name = "phpw" ascii wide nocase
        $alias_1 = "trojan:win32/phpw" ascii wide nocase
        $alias_2 = "trojan.phpw" ascii wide nocase
        $alias_3 = "backdoor:win32/phpw" ascii wide nocase
        $alias_4 = "win32/phpw" ascii wide nocase
        $alias_5 = "trojan-spy.win32.phpw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PHPW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Phpw tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phpw"
        date = "2026-10-16"
    strings:
        $attrib_str = "phpw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Phtg (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/phtg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PHTG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Phtg (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phtg"
        date = "2026-10-16"
    strings:
        $fam_name = "phtg" ascii wide nocase
        $alias_1 = "generic.phtg" ascii wide nocase
        $alias_2 = "pup.phtg" ascii wide nocase
        $alias_3 = "trojan.generic.phtg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PHTG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Phtg tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/phtg"
        date = "2026-10-16"
    strings:
        $attrib_str = "phtg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Picsys (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/picsys
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PICSYS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Picsys (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/picsys"
        date = "2026-10-16"
    strings:
        $fam_name = "picsys" ascii wide nocase
        $alias_1 = "trojan:win32/picsys" ascii wide nocase
        $alias_2 = "trojan.win32.picsys" ascii wide nocase
        $alias_3 = "worm.win32.picsys" ascii wide nocase
        $alias_4 = "win32/picsys" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PICSYS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Picsys tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/picsys"
        date = "2026-10-16"
    strings:
        $attrib_str = "picsys" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pidgeon (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pidgeon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PIDGEON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pidgeon (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pidgeon"
        date = "2026-10-16"
    strings:
        $fam_name = "pidgeon" ascii wide nocase
        $alias_1 = "trojandownloader:win32/pidgeon" ascii wide nocase
        $alias_2 = "trojan:win32/pidgeon" ascii wide nocase
        $alias_3 = "trojan.pidgeon" ascii wide nocase
        $alias_4 = "win32/pidgeon" ascii wide nocase
        $alias_5 = "trojandownloader:win32/pidgeon.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PIDGEON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pidgeon tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pidgeon"
        date = "2026-10-16"
    strings:
        $attrib_str = "pidgeon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pidmecc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pidmecc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PIDMECC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pidmecc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pidmecc"
        date = "2026-10-16"
    strings:
        $fam_name = "pidmecc" ascii wide nocase
        $alias_1 = "trojan.pidmecc" ascii wide nocase
        $alias_2 = "downloader.pidmecc" ascii wide nocase
        $alias_3 = "win32/pidmecc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PIDMECC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pidmecc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pidmecc"
        date = "2026-10-16"
    strings:
        $attrib_str = "pidmecc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pieshua (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pieshua
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PIESHUA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pieshua (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pieshua"
        date = "2026-10-16"
    strings:
        $fam_name = "pieshua" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PIESHUA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pieshua tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pieshua"
        date = "2026-10-16"
    strings:
        $attrib_str = "pieshua" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pikabot (Loader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pikabot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PIKABOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pikabot (Loader)"
        category = "Loader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pikabot"
        date = "2026-10-16"
    strings:
        $fam_name = "pikabot" ascii wide nocase
        $alias_1 = "pikabot" ascii wide nocase
        $alias_2 = "pika_bot" ascii wide nocase
        $alias_3 = "win32/pikabot" ascii wide nocase
        $alias_4 = "trojan.pikabot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PIKABOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pikabot tradecraft"
        category = "Loader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pikabot"
        date = "2026-10-16"
    strings:
        $attrib_str = "pikabot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pikachu (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pikachu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PIKACHU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pikachu (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pikachu"
        date = "2026-10-16"
    strings:
        $fam_name = "pikachu" ascii wide nocase
        $alias_1 = "w32/pikachu.worm" ascii wide nocase
        $alias_2 = "worm.pikachu" ascii wide nocase
        $alias_3 = "pikachu.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PIKACHU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pikachu tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pikachu"
        date = "2026-10-16"
    strings:
        $attrib_str = "pikachu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Piker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/piker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PIKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Piker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/piker"
        date = "2026-10-16"
    strings:
        $fam_name = "piker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PIKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Piker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/piker"
        date = "2026-10-16"
    strings:
        $attrib_str = "piker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pincav (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pincav
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PINCAV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pincav (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pincav"
        date = "2026-10-16"
    strings:
        $fam_name = "pincav" ascii wide nocase
        $alias_1 = "adware:win32/pincav" ascii wide nocase
        $alias_2 = "pua:win32/pincav" ascii wide nocase
        $alias_3 = "trojan.win32.pincav" ascii wide nocase
        $alias_4 = "win32/pincav" ascii wide nocase
        $alias_5 = "adware.pincav" ascii wide nocase
        $alias_6 = "adware:win32/pincav.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PINCAV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pincav tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pincav"
        date = "2026-10-16"
    strings:
        $attrib_str = "pincav" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pincher (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pincher
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PINCHER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pincher (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pincher"
        date = "2026-10-16"
    strings:
        $fam_name = "pincher" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PINCHER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pincher tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pincher"
        date = "2026-10-16"
    strings:
        $attrib_str = "pincher" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pinkblocker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pinkblocker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PINKBLOCKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pinkblocker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pinkblocker"
        date = "2026-10-16"
    strings:
        $fam_name = "pinkblocker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PINKBLOCKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pinkblocker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pinkblocker"
        date = "2026-10-16"
    strings:
        $attrib_str = "pinkblocker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pintu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pintu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PINTU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pintu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pintu"
        date = "2026-10-16"
    strings:
        $fam_name = "pintu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PINTU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pintu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pintu"
        date = "2026-10-16"
    strings:
        $attrib_str = "pintu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pioneer (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pioneer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PIONEER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pioneer (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pioneer"
        date = "2026-10-16"
    strings:
        $fam_name = "pioneer" ascii wide nocase
        $alias_1 = "virus:win32/pioneer.a" ascii wide nocase
        $alias_2 = "virus.win32.pioneer" ascii wide nocase
        $alias_3 = "pe_pioneer" ascii wide nocase
        $alias_4 = "w32.pioneer" ascii wide nocase
        $alias_5 = "win32/pioneer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PIONEER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pioneer tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pioneer"
        date = "2026-10-16"
    strings:
        $attrib_str = "pioneer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pipo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pipo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PIPO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pipo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pipo"
        date = "2026-10-16"
    strings:
        $fam_name = "pipo" ascii wide nocase
        $alias_1 = "trojan.pipo" ascii wide nocase
        $alias_2 = "downloader.pipo" ascii wide nocase
        $alias_3 = "win32/pipo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PIPO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pipo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pipo"
        date = "2026-10-16"
    strings:
        $attrib_str = "pipo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pirminay (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pirminay
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PIRMINAY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pirminay (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pirminay"
        date = "2026-10-16"
    strings:
        $fam_name = "pirminay" ascii wide nocase
        $alias_1 = "trojan:win32/pirminay" ascii wide nocase
        $alias_2 = "pws:win32/pirminay" ascii wide nocase
        $alias_3 = "trojan-psw.win32.pirminay" ascii wide nocase
        $alias_4 = "pirminay stealer" ascii wide nocase
        $alias_5 = "win32/pirminay" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PIRMINAY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pirminay tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pirminay"
        date = "2026-10-16"
    strings:
        $attrib_str = "pirminay" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pitin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pitin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PITIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pitin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pitin"
        date = "2026-10-16"
    strings:
        $fam_name = "pitin" ascii wide nocase
        $alias_1 = "trojan.pitin" ascii wide nocase
        $alias_2 = "downloader.pitin" ascii wide nocase
        $alias_3 = "win32/pitin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PITIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pitin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pitin"
        date = "2026-10-16"
    strings:
        $attrib_str = "pitin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pizchao (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pizchao
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PIZCHAO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pizchao (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pizchao"
        date = "2026-10-16"
    strings:
        $fam_name = "pizchao" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PIZCHAO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pizchao tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pizchao"
        date = "2026-10-16"
    strings:
        $attrib_str = "pizchao" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pjtbinder (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pjtbinder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PJTBINDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pjtbinder (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pjtbinder"
        date = "2026-10-16"
    strings:
        $fam_name = "pjtbinder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PJTBINDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pjtbinder tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pjtbinder"
        date = "2026-10-16"
    strings:
        $attrib_str = "pjtbinder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pjzab0Jsupjb (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pjzab0jsupjb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PJZAB0JSUPJB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pjzab0Jsupjb (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pjzab0jsupjb"
        date = "2026-10-16"
    strings:
        $fam_name = "pjzab0jsupjb" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.pjzab0jsupjb" ascii wide nocase
        $alias_3 = "heur.pjzab0jsupjb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PJZAB0JSUPJB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pjzab0Jsupjb tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pjzab0jsupjb"
        date = "2026-10-16"
    strings:
        $attrib_str = "pjzab0jsupjb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Plasma (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/plasma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLASMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Plasma (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plasma"
        date = "2026-10-16"
    strings:
        $fam_name = "plasma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLASMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Plasma tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plasma"
        date = "2026-10-16"
    strings:
        $attrib_str = "plasma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Platan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/platan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLATAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Platan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/platan"
        date = "2026-10-16"
    strings:
        $fam_name = "platan" ascii wide nocase
        $alias_1 = "trojan.platan" ascii wide nocase
        $alias_2 = "downloader.platan" ascii wide nocase
        $alias_3 = "win32/platan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLATAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Platan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/platan"
        date = "2026-10-16"
    strings:
        $attrib_str = "platan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Playgames (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/playgames
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLAYGAMES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Playgames (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/playgames"
        date = "2026-10-16"
    strings:
        $fam_name = "playgames" ascii wide nocase
        $alias_1 = "adware.playgames" ascii wide nocase
        $alias_2 = "pup.playgames" ascii wide nocase
        $alias_3 = "browsermodifier:win32/playgames" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLAYGAMES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Playgames tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/playgames"
        date = "2026-10-16"
    strings:
        $attrib_str = "playgames" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Playtech (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/playtech
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLAYTECH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Playtech (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/playtech"
        date = "2026-10-16"
    strings:
        $fam_name = "playtech" ascii wide nocase
        $alias_1 = "pua:win32/playtech" ascii wide nocase
        $alias_2 = "adware:win32/playtech" ascii wide nocase
        $alias_3 = "pua.playtech" ascii wide nocase
        $alias_4 = "adware.playtech" ascii wide nocase
        $alias_5 = "win32/playtech" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLAYTECH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Playtech tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/playtech"
        date = "2026-10-16"
    strings:
        $attrib_str = "playtech" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Plead (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/plead
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLEAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Plead (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plead"
        date = "2026-10-16"
    strings:
        $fam_name = "plead" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLEAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Plead tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plead"
        date = "2026-10-16"
    strings:
        $attrib_str = "plead" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Plicker (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/plicker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLICKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Plicker (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plicker"
        date = "2026-10-16"
    strings:
        $fam_name = "plicker" ascii wide nocase
        $alias_1 = "adware.plicker" ascii wide nocase
        $alias_2 = "pup.plicker" ascii wide nocase
        $alias_3 = "win32/plicker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLICKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Plicker tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plicker"
        date = "2026-10-16"
    strings:
        $attrib_str = "plicker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Plimrost (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/plimrost
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLIMROST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Plimrost (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plimrost"
        date = "2026-10-16"
    strings:
        $fam_name = "plimrost" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLIMROST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Plimrost tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plimrost"
        date = "2026-10-16"
    strings:
        $attrib_str = "plimrost" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Plinch (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/plinch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLINCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Plinch (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plinch"
        date = "2026-10-16"
    strings:
        $fam_name = "plinch" ascii wide nocase
        $alias_1 = "trojan.pws.pinch" ascii wide nocase
        $alias_2 = "infostealer.plinch" ascii wide nocase
        $alias_3 = "linch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLINCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Plinch tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plinch"
        date = "2026-10-16"
    strings:
        $attrib_str = "plinch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pliskal (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pliskal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLISKAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pliskal (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pliskal"
        date = "2026-10-16"
    strings:
        $fam_name = "pliskal" ascii wide nocase
        $alias_1 = "trojan:win32/pliskal" ascii wide nocase
        $alias_2 = "trojan:win32/pliskal.a" ascii wide nocase
        $alias_3 = "trojandownloader:win32/pliskal" ascii wide nocase
        $alias_4 = "win32/pliskal" ascii wide nocase
        $alias_5 = "backdoor.win32.pliskal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLISKAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pliskal tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pliskal"
        date = "2026-10-16"
    strings:
        $attrib_str = "pliskal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ploprolo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ploprolo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLOPROLO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ploprolo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ploprolo"
        date = "2026-10-16"
    strings:
        $fam_name = "ploprolo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLOPROLO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ploprolo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ploprolo"
        date = "2026-10-16"
    strings:
        $attrib_str = "ploprolo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Plugs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/plugs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLUGS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Plugs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plugs"
        date = "2026-10-16"
    strings:
        $fam_name = "plugs" ascii wide nocase
        $alias_1 = "trojan.plugs" ascii wide nocase
        $alias_2 = "downloader.plugs" ascii wide nocase
        $alias_3 = "win32/plugs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLUGS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Plugs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plugs"
        date = "2026-10-16"
    strings:
        $attrib_str = "plugs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Plugx (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/plugx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLUGX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Plugx (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plugx"
        date = "2026-10-16"
    strings:
        $fam_name = "plugx" ascii wide nocase
        $alias_1 = "plugx" ascii wide nocase
        $alias_2 = "korplug" ascii wide nocase
        $alias_3 = "sogu" ascii wide nocase
        $alias_4 = "trojan.plugx" ascii wide nocase
        $alias_5 = "win32/plugx" ascii wide nocase
        $alias_6 = "backdoor.plugx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLUGX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Plugx tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/plugx"
        date = "2026-10-16"
    strings:
        $attrib_str = "plugx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Pluto (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pluto
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PLUTO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pluto (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pluto"
        date = "2026-10-16"
    strings:
        $fam_name = "pluto" ascii wide nocase
        $alias_1 = "worm:win32/pluto" ascii wide nocase
        $alias_2 = "trojan:win32/pluto" ascii wide nocase
        $alias_3 = "w32.pluto" ascii wide nocase
        $alias_4 = "worm.win32.pluto" ascii wide nocase
        $alias_5 = "win32/pluto" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PLUTO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pluto tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pluto"
        date = "2026-10-16"
    strings:
        $attrib_str = "pluto" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Podnuha (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/podnuha
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PODNUHA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Podnuha (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/podnuha"
        date = "2026-10-16"
    strings:
        $fam_name = "podnuha" ascii wide nocase
        $alias_1 = "adware.podnuha" ascii wide nocase
        $alias_2 = "pup.podnuha" ascii wide nocase
        $alias_3 = "browsermodifier:win32/podnuha" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PODNUHA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Podnuha tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/podnuha"
        date = "2026-10-16"
    strings:
        $attrib_str = "podnuha" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Poison (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/poison
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POISON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Poison (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/poison"
        date = "2026-10-16"
    strings:
        $fam_name = "poison" ascii wide nocase
        $alias_1 = "poison ivy" ascii wide nocase
        $alias_2 = "poisonivy" ascii wide nocase
        $alias_3 = "pivy" ascii wide nocase
        $alias_4 = "trojan.poisonivy" ascii wide nocase
        $alias_5 = "win32/poisonivy" ascii wide nocase
        $alias_6 = "backdoor.poisonivy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POISON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Poison tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/poison"
        date = "2026-10-16"
    strings:
        $attrib_str = "poison" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Polip (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/polip
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POLIP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Polip (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/polip"
        date = "2026-10-16"
    strings:
        $fam_name = "polip" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POLIP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Polip tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/polip"
        date = "2026-10-16"
    strings:
        $attrib_str = "polip" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Polycrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/polycrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POLYCRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Polycrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/polycrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "polycrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POLYCRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Polycrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/polycrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "polycrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Polypatch (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/polypatch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POLYPATCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Polypatch (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/polypatch"
        date = "2026-10-16"
    strings:
        $fam_name = "polypatch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POLYPATCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Polypatch tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/polypatch"
        date = "2026-10-16"
    strings:
        $attrib_str = "polypatch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pondfull (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pondfull
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PONDFULL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pondfull (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pondfull"
        date = "2026-10-16"
    strings:
        $fam_name = "pondfull" ascii wide nocase
        $alias_1 = "trojan.pondfull" ascii wide nocase
        $alias_2 = "downloader.pondfull" ascii wide nocase
        $alias_3 = "win32/pondfull" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PONDFULL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pondfull tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pondfull"
        date = "2026-10-16"
    strings:
        $attrib_str = "pondfull" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ponmocup (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ponmocup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PONMOCUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ponmocup (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ponmocup"
        date = "2026-10-16"
    strings:
        $fam_name = "ponmocup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PONMOCUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ponmocup tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ponmocup"
        date = "2026-10-16"
    strings:
        $attrib_str = "ponmocup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pontoeb (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pontoeb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PONTOEB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pontoeb (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pontoeb"
        date = "2026-10-16"
    strings:
        $fam_name = "pontoeb" ascii wide nocase
        $alias_1 = "adware.pontoeb" ascii wide nocase
        $alias_2 = "pup.pontoeb" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PONTOEB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pontoeb tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pontoeb"
        date = "2026-10-16"
    strings:
        $attrib_str = "pontoeb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pony (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pony
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PONY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pony (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pony"
        date = "2026-10-16"
    strings:
        $fam_name = "pony" ascii wide nocase
        $alias_1 = "fareit" ascii wide nocase
        $alias_2 = "siplog" ascii wide nocase
        $alias_3 = "trojan:win32/fareit" ascii wide nocase
        $alias_4 = "pws:win32/fareit" ascii wide nocase
        $alias_5 = "pony stealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PONY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pony tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pony"
        date = "2026-10-16"
    strings:
        $attrib_str = "pony" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ponystealer (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ponystealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PONYSTEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ponystealer (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ponystealer"
        date = "2026-10-16"
    strings:
        $fam_name = "ponystealer" ascii wide nocase
        $alias_1 = "pony" ascii wide nocase
        $alias_2 = "pony stealer" ascii wide nocase
        $alias_3 = "trojan:win32/ponystealer" ascii wide nocase
        $alias_4 = "pony loader" ascii wide nocase
        $alias_5 = "pws-pony" ascii wide nocase
        $alias_6 = "fareit-pony" ascii wide nocase
        $alias_7 = "trojan.pony" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PONYSTEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ponystealer tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ponystealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "ponystealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Popad (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/popad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POPAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Popad (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/popad"
        date = "2026-10-16"
    strings:
        $fam_name = "popad" ascii wide nocase
        $alias_1 = "adware.popad" ascii wide nocase
        $alias_2 = "pup.popad" ascii wide nocase
        $alias_3 = "browsermodifier:win32/popad" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POPAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Popad tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/popad"
        date = "2026-10-16"
    strings:
        $attrib_str = "popad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pophot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pophot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POPHOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pophot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pophot"
        date = "2026-10-16"
    strings:
        $fam_name = "pophot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POPHOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pophot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pophot"
        date = "2026-10-16"
    strings:
        $attrib_str = "pophot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Popwin (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/popwin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POPWIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Popwin (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/popwin"
        date = "2026-10-16"
    strings:
        $fam_name = "popwin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POPWIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Popwin tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/popwin"
        date = "2026-10-16"
    strings:
        $attrib_str = "popwin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Porex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/porex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POREX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Porex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/porex"
        date = "2026-10-16"
    strings:
        $fam_name = "porex" ascii wide nocase
        $alias_1 = "trojan.porex" ascii wide nocase
        $alias_2 = "downloader.porex" ascii wide nocase
        $alias_3 = "win32/porex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POREX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Porex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/porex"
        date = "2026-10-16"
    strings:
        $attrib_str = "porex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pornblackmailer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pornblackmailer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PORNBLACKMAILER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pornblackmailer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pornblackmailer"
        date = "2026-10-16"
    strings:
        $fam_name = "pornblackmailer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PORNBLACKMAILER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pornblackmailer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pornblackmailer"
        date = "2026-10-16"
    strings:
        $attrib_str = "pornblackmailer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pornoblocker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pornoblocker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PORNOBLOCKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pornoblocker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pornoblocker"
        date = "2026-10-16"
    strings:
        $fam_name = "pornoblocker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PORNOBLOCKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pornoblocker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pornoblocker"
        date = "2026-10-16"
    strings:
        $attrib_str = "pornoblocker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Porntool (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/porntool
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PORNTOOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Porntool (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/porntool"
        date = "2026-10-16"
    strings:
        $fam_name = "porntool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PORNTOOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Porntool tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/porntool"
        date = "2026-10-16"
    strings:
        $attrib_str = "porntool" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Poscardstealer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/poscardstealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POSCARDSTEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Poscardstealer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/poscardstealer"
        date = "2026-10-16"
    strings:
        $fam_name = "poscardstealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POSCARDSTEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Poscardstealer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/poscardstealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "poscardstealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Possiblemalware (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/possiblemalware
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POSSIBLEMALWARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Possiblemalware (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/possiblemalware"
        date = "2026-10-16"
    strings:
        $fam_name = "possiblemalware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POSSIBLEMALWARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Possiblemalware tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/possiblemalware"
        date = "2026-10-16"
    strings:
        $attrib_str = "possiblemalware" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Potao (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/potao
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POTAO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Potao (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/potao"
        date = "2026-10-16"
    strings:
        $fam_name = "potao" ascii wide nocase
        $alias_1 = "apt.potao" ascii wide nocase
        $alias_2 = "trojan.potao" ascii wide nocase
        $alias_3 = "backdoor.win32.potao" ascii wide nocase
        $alias_4 = "potao express" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POTAO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Potao tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/potao"
        date = "2026-10-16"
    strings:
        $attrib_str = "potao" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Potukorp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/potukorp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POTUKORP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Potukorp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/potukorp"
        date = "2026-10-16"
    strings:
        $fam_name = "potukorp" ascii wide nocase
        $alias_1 = "trojan.potukorp" ascii wide nocase
        $alias_2 = "downloader.potukorp" ascii wide nocase
        $alias_3 = "win32/potukorp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POTUKORP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Potukorp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/potukorp"
        date = "2026-10-16"
    strings:
        $attrib_str = "potukorp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Povertel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/povertel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POVERTEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Povertel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/povertel"
        date = "2026-10-16"
    strings:
        $fam_name = "povertel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POVERTEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Povertel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/povertel"
        date = "2026-10-16"
    strings:
        $attrib_str = "povertel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Powerless (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/powerless
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POWERLESS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Powerless (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powerless"
        date = "2026-10-16"
    strings:
        $fam_name = "powerless" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POWERLESS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Powerless tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powerless"
        date = "2026-10-16"
    strings:
        $attrib_str = "powerless" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Powerspritz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/powerspritz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POWERSPRITZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Powerspritz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powerspritz"
        date = "2026-10-16"
    strings:
        $fam_name = "powerspritz" ascii wide nocase
        $alias_1 = "trojan.powerspritz" ascii wide nocase
        $alias_2 = "fileless.powerspritz" ascii wide nocase
        $alias_3 = "powershell.downloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POWERSPRITZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Powerspritz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powerspritz"
        date = "2026-10-16"
    strings:
        $attrib_str = "powerspritz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Powerun (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/powerun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POWERUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Powerun (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powerun"
        date = "2026-10-16"
    strings:
        $fam_name = "powerun" ascii wide nocase
        $alias_1 = "hacktool.powerun" ascii wide nocase
        $alias_2 = "riskware.powershellrunner" ascii wide nocase
        $alias_3 = "trojan.powerun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POWERUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Powerun tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powerun"
        date = "2026-10-16"
    strings:
        $attrib_str = "powerun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Powp (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/powp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POWP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Powp (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powp"
        date = "2026-10-16"
    strings:
        $fam_name = "powp" ascii wide nocase
        $alias_1 = "adware:win32/powp" ascii wide nocase
        $alias_2 = "trojan:win32/powp" ascii wide nocase
        $alias_3 = "pua:win32/powp" ascii wide nocase
        $alias_4 = "win32/powp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POWP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Powp tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powp"
        date = "2026-10-16"
    strings:
        $attrib_str = "powp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Powstage (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/powstage
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POWSTAGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Powstage (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powstage"
        date = "2026-10-16"
    strings:
        $fam_name = "powstage" ascii wide nocase
        $alias_1 = "trojan.powstage" ascii wide nocase
        $alias_2 = "powershell.stager" ascii wide nocase
        $alias_3 = "trojan.downloader.powershell" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POWSTAGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Powstage tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powstage"
        date = "2026-10-16"
    strings:
        $attrib_str = "powstage" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Powzip (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/powzip
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POWZIP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Powzip (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powzip"
        date = "2026-10-16"
    strings:
        $fam_name = "powzip" ascii wide nocase
        $alias_1 = "ransom:win32/powzip" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.powzip" ascii wide nocase
        $alias_3 = "win32/powzip" ascii wide nocase
        $alias_4 = "powzip ransomware" ascii wide nocase
        $alias_5 = "ransom.powzip" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POWZIP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Powzip tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/powzip"
        date = "2026-10-16"
    strings:
        $attrib_str = "powzip" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Poxters (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/poxters
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_POXTERS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Poxters (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/poxters"
        date = "2026-10-16"
    strings:
        $fam_name = "poxters" ascii wide nocase
        $alias_1 = "trojan.poxters" ascii wide nocase
        $alias_2 = "downloader.poxters" ascii wide nocase
        $alias_3 = "win32/poxters" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_POXTERS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Poxters tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/poxters"
        date = "2026-10-16"
    strings:
        $attrib_str = "poxters" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pramro (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pramro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PRAMRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pramro (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pramro"
        date = "2026-10-16"
    strings:
        $fam_name = "pramro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PRAMRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pramro tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pramro"
        date = "2026-10-16"
    strings:
        $attrib_str = "pramro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Prast (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/prast
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PRAST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Prast (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prast"
        date = "2026-10-16"
    strings:
        $fam_name = "prast" ascii wide nocase
        $alias_1 = "adware.prast" ascii wide nocase
        $alias_2 = "pup.prast" ascii wide nocase
        $alias_3 = "browsermodifier:win32/prast" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PRAST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Prast tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prast"
        date = "2026-10-16"
    strings:
        $attrib_str = "prast" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Predator (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/predator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PREDATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Predator (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/predator"
        date = "2026-10-16"
    strings:
        $fam_name = "predator" ascii wide nocase
        $alias_1 = "predator spyware" ascii wide nocase
        $alias_2 = "cytrox predator" ascii wide nocase
        $alias_3 = "intellexa predator" ascii wide nocase
        $alias_4 = "alien/predator" ascii wide nocase
        $alias_5 = "spyware:android/predator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PREDATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Predator tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/predator"
        date = "2026-10-16"
    strings:
        $attrib_str = "predator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Predatorthief (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/predatorthief
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PREDATORTHIEF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Predatorthief (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/predatorthief"
        date = "2026-10-16"
    strings:
        $fam_name = "predatorthief" ascii wide nocase
        $alias_1 = "trojan.predatorthethief" ascii wide nocase
        $alias_2 = "pws.predator" ascii wide nocase
        $alias_3 = "trojanspy.predatorthief" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PREDATORTHIEF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Predatorthief tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/predatorthief"
        date = "2026-10-16"
    strings:
        $attrib_str = "predatorthief" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Premium (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/premium
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PREMIUM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Premium (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/premium"
        date = "2026-10-16"
    strings:
        $fam_name = "premium" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PREMIUM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Premium tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/premium"
        date = "2026-10-16"
    strings:
        $attrib_str = "premium" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Prepscram (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/prepscram
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PREPSCRAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Prepscram (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prepscram"
        date = "2026-10-16"
    strings:
        $fam_name = "prepscram" ascii wide nocase
        $alias_1 = "prepscram" ascii wide nocase
        $alias_2 = "softwarebundler:win32/prepscram" ascii wide nocase
        $alias_3 = "trojan.prepscram" ascii wide nocase
        $alias_4 = "win32/prepscram" ascii wide nocase
        $alias_5 = "bundler:win32/prepscram" ascii wide nocase
        $alias_6 = "prepscram bundler" ascii wide nocase
        $alias_7 = "adware.prepscram" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PREPSCRAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Prepscram tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prepscram"
        date = "2026-10-16"
    strings:
        $attrib_str = "prepscram" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pres (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pres
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PRES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pres (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pres"
        date = "2026-10-16"
    strings:
        $fam_name = "pres" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PRES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pres tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pres"
        date = "2026-10-16"
    strings:
        $attrib_str = "pres" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Presenoker (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/presenoker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PRESENOKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Presenoker (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/presenoker"
        date = "2026-10-16"
    strings:
        $fam_name = "presenoker" ascii wide nocase
        $alias_1 = "presenoker" ascii wide nocase
        $alias_2 = "pua:win32/presenoker" ascii wide nocase
        $alias_3 = "win32/presenoker" ascii wide nocase
        $alias_4 = "adware.presenoker" ascii wide nocase
        $alias_5 = "presenoker bundler" ascii wide nocase
        $alias_6 = "pup.optional.presenoker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PRESENOKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Presenoker tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/presenoker"
        date = "2026-10-16"
    strings:
        $attrib_str = "presenoker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Prex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/prex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PREX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Prex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prex"
        date = "2026-10-16"
    strings:
        $fam_name = "prex" ascii wide nocase
        $alias_1 = "trojan.prex" ascii wide nocase
        $alias_2 = "downloader.prex" ascii wide nocase
        $alias_3 = "win32/prex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PREX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Prex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prex"
        date = "2026-10-16"
    strings:
        $attrib_str = "prex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Primarypass (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/primarypass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PRIMARYPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Primarypass (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/primarypass"
        date = "2026-10-16"
    strings:
        $fam_name = "primarypass" ascii wide nocase
        $alias_1 = "adware:win32/primarypass" ascii wide nocase
        $alias_2 = "pua:win32/primarypass" ascii wide nocase
        $alias_3 = "browsermodifier:win32/primarypass" ascii wide nocase
        $alias_4 = "win32/primarypass" ascii wide nocase
        $alias_5 = "adware.primarypass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PRIMARYPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Primarypass tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/primarypass"
        date = "2026-10-16"
    strings:
        $attrib_str = "primarypass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Primawega (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/primawega
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PRIMAWEGA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Primawega (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/primawega"
        date = "2026-10-16"
    strings:
        $fam_name = "primawega" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PRIMAWEGA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Primawega tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/primawega"
        date = "2026-10-16"
    strings:
        $attrib_str = "primawega" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Primecasino (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/primecasino
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PRIMECASINO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Primecasino (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/primecasino"
        date = "2026-10-16"
    strings:
        $fam_name = "primecasino" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PRIMECASINO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Primecasino tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/primecasino"
        date = "2026-10-16"
    strings:
        $attrib_str = "primecasino" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Prjraptor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/prjraptor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PRJRAPTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Prjraptor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prjraptor"
        date = "2026-10-16"
    strings:
        $fam_name = "prjraptor" ascii wide nocase
        $alias_1 = "project raptor" ascii wide nocase
        $alias_2 = "prjraptor" ascii wide nocase
        $alias_3 = "backdoor.win32.prjraptor" ascii wide nocase
        $alias_4 = "trojan.prjraptor" ascii wide nocase
        $alias_5 = "win32/prjraptor.rat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PRJRAPTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Prjraptor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prjraptor"
        date = "2026-10-16"
    strings:
        $attrib_str = "prjraptor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Processhijack (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/processhijack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROCESSHIJACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Processhijack (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/processhijack"
        date = "2026-10-16"
    strings:
        $fam_name = "processhijack" ascii wide nocase
        $alias_1 = "trojan:win32/processhijack" ascii wide nocase
        $alias_2 = "trojan:win32/processhijack.gtm!mtb" ascii wide nocase
        $alias_3 = "win32/processhijack" ascii wide nocase
        $alias_4 = "trojan.processhijack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROCESSHIJACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Processhijack tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/processhijack"
        date = "2026-10-16"
    strings:
        $attrib_str = "processhijack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Procgmar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/procgmar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROCGMAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Procgmar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/procgmar"
        date = "2026-10-16"
    strings:
        $fam_name = "procgmar" ascii wide nocase
        $alias_1 = "trojan.procgmar" ascii wide nocase
        $alias_2 = "downloader.procgmar" ascii wide nocase
        $alias_3 = "win32/procgmar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROCGMAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Procgmar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/procgmar"
        date = "2026-10-16"
    strings:
        $attrib_str = "procgmar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Prochack (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/prochack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROCHACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Prochack (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prochack"
        date = "2026-10-16"
    strings:
        $fam_name = "prochack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROCHACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Prochack tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prochack"
        date = "2026-10-16"
    strings:
        $attrib_str = "prochack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Procpatcher (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/procpatcher
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROCPATCHER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Procpatcher (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/procpatcher"
        date = "2026-10-16"
    strings:
        $fam_name = "procpatcher" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROCPATCHER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Procpatcher tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/procpatcher"
        date = "2026-10-16"
    strings:
        $attrib_str = "procpatcher" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Progressive (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/progressive
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROGRESSIVE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Progressive (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/progressive"
        date = "2026-10-16"
    strings:
        $fam_name = "progressive" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROGRESSIVE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Progressive tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/progressive"
        date = "2026-10-16"
    strings:
        $attrib_str = "progressive" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Proinstall (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/proinstall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROINSTALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Proinstall (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/proinstall"
        date = "2026-10-16"
    strings:
        $fam_name = "proinstall" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROINSTALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Proinstall tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/proinstall"
        date = "2026-10-16"
    strings:
        $attrib_str = "proinstall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Propagate (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/propagate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROPAGATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Propagate (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/propagate"
        date = "2026-10-16"
    strings:
        $fam_name = "propagate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROPAGATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Propagate tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/propagate"
        date = "2026-10-16"
    strings:
        $attrib_str = "propagate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Prorat (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/prorat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PRORAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Prorat (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prorat"
        date = "2026-10-16"
    strings:
        $fam_name = "prorat" ascii wide nocase
        $alias_1 = "backdoor:win32/prorat" ascii wide nocase
        $alias_2 = "trojan:win32/prorat" ascii wide nocase
        $alias_3 = "backdoor.prorat" ascii wide nocase
        $alias_4 = "win32/prorat" ascii wide nocase
        $alias_5 = "prorat server" ascii wide nocase
        $alias_6 = "prorat trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PRORAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Prorat tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prorat"
        date = "2026-10-16"
    strings:
        $attrib_str = "prorat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Prosti (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/prosti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROSTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Prosti (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prosti"
        date = "2026-10-16"
    strings:
        $fam_name = "prosti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROSTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Prosti tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/prosti"
        date = "2026-10-16"
    strings:
        $attrib_str = "prosti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Protector (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/protector
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROTECTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Protector (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/protector"
        date = "2026-10-16"
    strings:
        $fam_name = "protector" ascii wide nocase
        $alias_1 = "rogue.protector" ascii wide nocase
        $alias_2 = "scareware.protector" ascii wide nocase
        $alias_3 = "win32/fakeav.protector" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROTECTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Protector tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/protector"
        date = "2026-10-16"
    strings:
        $attrib_str = "protector" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Proteus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/proteus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROTEUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Proteus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/proteus"
        date = "2026-10-16"
    strings:
        $fam_name = "proteus" ascii wide nocase
        $alias_1 = "botnet.proteus" ascii wide nocase
        $alias_2 = "trojan.proteus" ascii wide nocase
        $alias_3 = "win32/proteus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROTEUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Proteus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/proteus"
        date = "2026-10-16"
    strings:
        $attrib_str = "proteus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Protux (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/protux
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROTUX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Protux (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/protux"
        date = "2026-10-16"
    strings:
        $fam_name = "protux" ascii wide nocase
        $alias_1 = "backdoor:win32/protux" ascii wide nocase
        $alias_2 = "trojan:win32/protux" ascii wide nocase
        $alias_3 = "backdoor.protux" ascii wide nocase
        $alias_4 = "win32/protux" ascii wide nocase
        $alias_5 = "trojan.protux" ascii wide nocase
        $alias_6 = "backdoor:win32/protux.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROTUX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Protux tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/protux"
        date = "2026-10-16"
    strings:
        $attrib_str = "protux" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Proxyagent (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/proxyagent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROXYAGENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Proxyagent (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/proxyagent"
        date = "2026-10-16"
    strings:
        $fam_name = "proxyagent" ascii wide nocase
        $alias_1 = "trojan.proxyagent" ascii wide nocase
        $alias_2 = "proxy.botnet" ascii wide nocase
        $alias_3 = "win32/proxyagent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROXYAGENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Proxyagent tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/proxyagent"
        date = "2026-10-16"
    strings:
        $attrib_str = "proxyagent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Proxygate (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/proxygate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROXYGATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Proxygate (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/proxygate"
        date = "2026-10-16"
    strings:
        $fam_name = "proxygate" ascii wide nocase
        $alias_1 = "riskware.proxygate" ascii wide nocase
        $alias_2 = "pup.proxytool" ascii wide nocase
        $alias_3 = "tool.vpnbypass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROXYGATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Proxygate tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/proxygate"
        date = "2026-10-16"
    strings:
        $attrib_str = "proxygate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Proxyweb (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/proxyweb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PROXYWEB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Proxyweb (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/proxyweb"
        date = "2026-10-16"
    strings:
        $fam_name = "proxyweb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PROXYWEB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Proxyweb tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/proxyweb"
        date = "2026-10-16"
    strings:
        $attrib_str = "proxyweb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Psdownload (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/psdownload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PSDOWNLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Psdownload (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psdownload"
        date = "2026-10-16"
    strings:
        $fam_name = "psdownload" ascii wide nocase
        $alias_1 = "trojandownloader:powershell/psdownload" ascii wide nocase
        $alias_2 = "trojan:powershell/psdownload.a" ascii wide nocase
        $alias_3 = "trojandownloader:powershell/psdownload.b" ascii wide nocase
        $alias_4 = "powershell/downloader.psdownload" ascii wide nocase
        $alias_5 = "trojan:powershell/psdownload!msr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PSDOWNLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Psdownload tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psdownload"
        date = "2026-10-16"
    strings:
        $attrib_str = "psdownload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Psexec (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/psexec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PSEXEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Psexec (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psexec"
        date = "2026-10-16"
    strings:
        $fam_name = "psexec" ascii wide nocase
        $alias_1 = "hacktool.psexec" ascii wide nocase
        $alias_2 = "sysinternals.psexec" ascii wide nocase
        $alias_3 = "lateralmovement.tool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PSEXEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Psexec tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psexec"
        date = "2026-10-16"
    strings:
        $attrib_str = "psexec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pshell (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pshell
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PSHELL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pshell (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pshell"
        date = "2026-10-16"
    strings:
        $fam_name = "pshell" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PSHELL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pshell tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pshell"
        date = "2026-10-16"
    strings:
        $attrib_str = "pshell" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Psloader (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/psloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PSLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Psloader (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psloader"
        date = "2026-10-16"
    strings:
        $fam_name = "psloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PSLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Psloader tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "psloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Psshell (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/psshell
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PSSHELL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Psshell (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psshell"
        date = "2026-10-16"
    strings:
        $fam_name = "psshell" ascii wide nocase
        $alias_1 = "hacktool.psshell" ascii wide nocase
        $alias_2 = "riskware.powershell" ascii wide nocase
        $alias_3 = "trojan.powershell.reverseshell" ascii wide nocase
        $alias_4 = "nishang" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PSSHELL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Psshell tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psshell"
        date = "2026-10-16"
    strings:
        $attrib_str = "psshell" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pstinb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pstinb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PSTINB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pstinb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pstinb"
        date = "2026-10-16"
    strings:
        $fam_name = "pstinb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PSTINB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pstinb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pstinb"
        date = "2026-10-16"
    strings:
        $attrib_str = "pstinb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pswdump (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pswdump
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PSWDUMP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pswdump (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pswdump"
        date = "2026-10-16"
    strings:
        $fam_name = "pswdump" ascii wide nocase
        $alias_1 = "hacktool.pswdump" ascii wide nocase
        $alias_2 = "tool.pwdump" ascii wide nocase
        $alias_3 = "riskware.credentialdumper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PSWDUMP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pswdump tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pswdump"
        date = "2026-10-16"
    strings:
        $attrib_str = "pswdump" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pswtool (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pswtool
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PSWTOOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pswtool (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pswtool"
        date = "2026-10-16"
    strings:
        $fam_name = "pswtool" ascii wide nocase
        $alias_1 = "hacktool:win32/pswtool" ascii wide nocase
        $alias_2 = "tool:win32/pswtool" ascii wide nocase
        $alias_3 = "win32/pswtool" ascii wide nocase
        $alias_4 = "pswtool password dumper" ascii wide nocase
        $alias_5 = "riskware.pswtool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PSWTOOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pswtool tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pswtool"
        date = "2026-10-16"
    strings:
        $attrib_str = "pswtool" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Psyme (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/psyme
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PSYME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Psyme (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psyme"
        date = "2026-10-16"
    strings:
        $fam_name = "psyme" ascii wide nocase
        $alias_1 = "js/psyme" ascii wide nocase
        $alias_2 = "vbs/psyme" ascii wide nocase
        $alias_3 = "trojandownloader:js/psyme" ascii wide nocase
        $alias_4 = "win32/psyme" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PSYME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Psyme tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psyme"
        date = "2026-10-16"
    strings:
        $attrib_str = "psyme" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Psyokym (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/psyokym
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PSYOKYM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Psyokym (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psyokym"
        date = "2026-10-16"
    strings:
        $fam_name = "psyokym" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PSYOKYM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Psyokym tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/psyokym"
        date = "2026-10-16"
    strings:
        $attrib_str = "psyokym" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pterodo (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pterodo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PTERODO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pterodo (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pterodo"
        date = "2026-10-16"
    strings:
        $fam_name = "pterodo" ascii wide nocase
        $alias_1 = "backdoor:win32/pterodo" ascii wide nocase
        $alias_2 = "trojan:win32/pterodo" ascii wide nocase
        $alias_3 = "backdoor.pteranodon" ascii wide nocase
        $alias_4 = "win32/pteranodon" ascii wide nocase
        $alias_5 = "pteranodon rat" ascii wide nocase
        $alias_6 = "gamaredon pterodo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PTERODO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pterodo tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pterodo"
        date = "2026-10-16"
    strings:
        $attrib_str = "pterodo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Puamson (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/puamson
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PUAMSON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Puamson (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/puamson"
        date = "2026-10-16"
    strings:
        $fam_name = "puamson" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PUAMSON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Puamson tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/puamson"
        date = "2026-10-16"
    strings:
        $attrib_str = "puamson" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pullupdate (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pullupdate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PULLUPDATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pullupdate (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pullupdate"
        date = "2026-10-16"
    strings:
        $fam_name = "pullupdate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PULLUPDATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pullupdate tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pullupdate"
        date = "2026-10-16"
    strings:
        $attrib_str = "pullupdate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pulobe (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pulobe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PULOBE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pulobe (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pulobe"
        date = "2026-10-16"
    strings:
        $fam_name = "pulobe" ascii wide nocase
        $alias_1 = "trojan.pulobe" ascii wide nocase
        $alias_2 = "downloader.pulobe" ascii wide nocase
        $alias_3 = "win32/pulobe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PULOBE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pulobe tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pulobe"
        date = "2026-10-16"
    strings:
        $attrib_str = "pulobe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Puontib (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/puontib
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PUONTIB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Puontib (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/puontib"
        date = "2026-10-16"
    strings:
        $fam_name = "puontib" ascii wide nocase
        $alias_1 = "trojan.puontib" ascii wide nocase
        $alias_2 = "downloader.puontib" ascii wide nocase
        $alias_3 = "win32/puontib" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PUONTIB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Puontib tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/puontib"
        date = "2026-10-16"
    strings:
        $attrib_str = "puontib" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pupstudio (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pupstudio
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PUPSTUDIO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pupstudio (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pupstudio"
        date = "2026-10-16"
    strings:
        $fam_name = "pupstudio" ascii wide nocase
        $alias_1 = "pua:win32/pupstudio" ascii wide nocase
        $alias_2 = "softwarebundler:win32/pupstudio" ascii wide nocase
        $alias_3 = "pup.optional.pupstudio" ascii wide nocase
        $alias_4 = "win32/pupstudio" ascii wide nocase
        $alias_5 = "softwarebundler:win32/pupstudio.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PUPSTUDIO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pupstudio tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pupstudio"
        date = "2026-10-16"
    strings:
        $attrib_str = "pupstudio" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Purga (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/purga
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PURGA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Purga (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/purga"
        date = "2026-10-16"
    strings:
        $fam_name = "purga" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PURGA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Purga tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/purga"
        date = "2026-10-16"
    strings:
        $attrib_str = "purga" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Purgen (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/purgen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PURGEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Purgen (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/purgen"
        date = "2026-10-16"
    strings:
        $fam_name = "purgen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PURGEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Purgen tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/purgen"
        date = "2026-10-16"
    strings:
        $attrib_str = "purgen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Purgory (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/purgory
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PURGORY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Purgory (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/purgory"
        date = "2026-10-16"
    strings:
        $fam_name = "purgory" ascii wide nocase
        $alias_1 = "trojan.purgory" ascii wide nocase
        $alias_2 = "downloader.purgory" ascii wide nocase
        $alias_3 = "win32/purgory" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PURGORY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Purgory tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/purgory"
        date = "2026-10-16"
    strings:
        $attrib_str = "purgory" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Purityscan (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/purityscan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PURITYSCAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Purityscan (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/purityscan"
        date = "2026-10-16"
    strings:
        $fam_name = "purityscan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PURITYSCAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Purityscan tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/purityscan"
        date = "2026-10-16"
    strings:
        $attrib_str = "purityscan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pushel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pushel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PUSHEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pushel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pushel"
        date = "2026-10-16"
    strings:
        $fam_name = "pushel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PUSHEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pushel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pushel"
        date = "2026-10-16"
    strings:
        $attrib_str = "pushel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Putabmow (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/putabmow
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PUTABMOW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Putabmow (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/putabmow"
        date = "2026-10-16"
    strings:
        $fam_name = "putabmow" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PUTABMOW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Putabmow tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/putabmow"
        date = "2026-10-16"
    strings:
        $attrib_str = "putabmow" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Puwaders (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/puwaders
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PUWADERS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Puwaders (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/puwaders"
        date = "2026-10-16"
    strings:
        $fam_name = "puwaders" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PUWADERS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Puwaders tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/puwaders"
        date = "2026-10-16"
    strings:
        $attrib_str = "puwaders" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pwdump (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pwdump
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PWDUMP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pwdump (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pwdump"
        date = "2026-10-16"
    strings:
        $fam_name = "pwdump" ascii wide nocase
        $alias_1 = "hacktool.pwdump" ascii wide nocase
        $alias_2 = "riskware.pwdump" ascii wide nocase
        $alias_3 = "win32/pwdump" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PWDUMP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pwdump tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pwdump"
        date = "2026-10-16"
    strings:
        $attrib_str = "pwdump" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pwkiller (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pwkiller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PWKILLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pwkiller (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pwkiller"
        date = "2026-10-16"
    strings:
        $fam_name = "pwkiller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PWKILLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pwkiller tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pwkiller"
        date = "2026-10-16"
    strings:
        $attrib_str = "pwkiller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pwsime (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pwsime
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PWSIME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pwsime (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pwsime"
        date = "2026-10-16"
    strings:
        $fam_name = "pwsime" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PWSIME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pwsime tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pwsime"
        date = "2026-10-16"
    strings:
        $attrib_str = "pwsime" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pwszbot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pwszbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PWSZBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pwszbot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pwszbot"
        date = "2026-10-16"
    strings:
        $fam_name = "pwszbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PWSZBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pwszbot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pwszbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "pwszbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pycrypter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pycrypter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PYCRYPTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pycrypter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pycrypter"
        date = "2026-10-16"
    strings:
        $fam_name = "pycrypter" ascii wide nocase
        $alias_1 = "ransom.pycrypter" ascii wide nocase
        $alias_2 = "python.ransomware" ascii wide nocase
        $alias_3 = "win32/filecoder.python" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PYCRYPTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pycrypter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pycrypter"
        date = "2026-10-16"
    strings:
        $attrib_str = "pycrypter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pyfiledel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pyfiledel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PYFILEDEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pyfiledel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pyfiledel"
        date = "2026-10-16"
    strings:
        $fam_name = "pyfiledel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PYFILEDEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pyfiledel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pyfiledel"
        date = "2026-10-16"
    strings:
        $attrib_str = "pyfiledel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pyinstaller (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pyinstaller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PYINSTALLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pyinstaller (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pyinstaller"
        date = "2026-10-16"
    strings:
        $fam_name = "pyinstaller" ascii wide nocase
        $alias_1 = "suspicious.pyinstaller" ascii wide nocase
        $alias_2 = "trojan.python" ascii wide nocase
        $alias_3 = "heur.pyinstaller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PYINSTALLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pyinstaller tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pyinstaller"
        date = "2026-10-16"
    strings:
        $attrib_str = "pyinstaller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pykspa (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pykspa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PYKSPA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pykspa (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pykspa"
        date = "2026-10-16"
    strings:
        $fam_name = "pykspa" ascii wide nocase
        $alias_1 = "w32/pykspa" ascii wide nocase
        $alias_2 = "worm:win32/pykspa" ascii wide nocase
        $alias_3 = "skype worm pykspa" ascii wide nocase
        $alias_4 = "w32.pykspa" ascii wide nocase
        $alias_5 = "win32/pykspa.worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PYKSPA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pykspa tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pykspa"
        date = "2026-10-16"
    strings:
        $attrib_str = "pykspa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pyme (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pyme
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PYME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pyme (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pyme"
        date = "2026-10-16"
    strings:
        $fam_name = "pyme" ascii wide nocase
        $alias_1 = "worm.pyme" ascii wide nocase
        $alias_2 = "trojan.pyme" ascii wide nocase
        $alias_3 = "win32/pyme" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PYME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pyme tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pyme"
        date = "2026-10-16"
    strings:
        $attrib_str = "pyme" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Pynamer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pynamer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PYNAMER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pynamer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pynamer"
        date = "2026-10-16"
    strings:
        $fam_name = "pynamer" ascii wide nocase
        $alias_1 = "trojan:win32/pynamer" ascii wide nocase
        $alias_2 = "trojan.pynamer" ascii wide nocase
        $alias_3 = "trojan:win32/pynamer!ac" ascii wide nocase
        $alias_4 = "win32/pynamer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PYNAMER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pynamer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pynamer"
        date = "2026-10-16"
    strings:
        $attrib_str = "pynamer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Pyspy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pyspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PYSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pyspy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pyspy"
        date = "2026-10-16"
    strings:
        $fam_name = "pyspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PYSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pyspy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pyspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "pyspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Qaccel (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qaccel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QACCEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qaccel (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qaccel"
        date = "2026-10-16"
    strings:
        $fam_name = "qaccel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QACCEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qaccel tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qaccel"
        date = "2026-10-16"
    strings:
        $attrib_str = "qaccel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Qadars (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qadars
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QADARS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qadars (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qadars"
        date = "2026-10-16"
    strings:
        $fam_name = "qadars" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QADARS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qadars tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qadars"
        date = "2026-10-16"
    strings:
        $attrib_str = "qadars" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Qbot (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qbot (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qbot"
        date = "2026-10-16"
    strings:
        $fam_name = "qbot" ascii wide nocase
        $alias_1 = "qakbot" ascii wide nocase
        $alias_2 = "pinkslipbot" ascii wide nocase
        $alias_3 = "trojan.qbot" ascii wide nocase
        $alias_4 = "banking.qakbot" ascii wide nocase
        $alias_5 = "win32/qakbot" ascii wide nocase
        $alias_6 = "qbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qbot tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "qbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Qdownb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qdownb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QDOWNB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qdownb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qdownb"
        date = "2026-10-16"
    strings:
        $fam_name = "qdownb" ascii wide nocase
        $alias_1 = "trojan.qdownb" ascii wide nocase
        $alias_2 = "downloader.qdownb" ascii wide nocase
        $alias_3 = "win32/qdownb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QDOWNB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qdownb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qdownb"
        date = "2026-10-16"
    strings:
        $attrib_str = "qdownb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Qhost (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qhost
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QHOST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qhost (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qhost"
        date = "2026-10-16"
    strings:
        $fam_name = "qhost" ascii wide nocase
        $alias_1 = "qhost" ascii wide nocase
        $alias_2 = "trojan:win32/qhost" ascii wide nocase
        $alias_3 = "troj_qhost" ascii wide nocase
        $alias_4 = "dnschanger.qhost" ascii wide nocase
        $alias_5 = "win32/qhost" ascii wide nocase
        $alias_6 = "trojan.qhost" ascii wide nocase
        $alias_7 = "qhosts redirector" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QHOST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qhost tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qhost"
        date = "2026-10-16"
    strings:
        $attrib_str = "qhost" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Qhosts (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qhosts
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QHOSTS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qhosts (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qhosts"
        date = "2026-10-16"
    strings:
        $fam_name = "qhosts" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QHOSTS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qhosts tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qhosts"
        date = "2026-10-16"
    strings:
        $attrib_str = "qhosts" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Qjwmonkey (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qjwmonkey
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QJWMONKEY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qjwmonkey (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qjwmonkey"
        date = "2026-10-16"
    strings:
        $fam_name = "qjwmonkey" ascii wide nocase
        $alias_1 = "puaadvertising:win32/qjwmonkey" ascii wide nocase
        $alias_2 = "adware:win32/qjwmonkey.a!msr" ascii wide nocase
        $alias_3 = "pua.qjwmonkey" ascii wide nocase
        $alias_4 = "win32/qjwmonkey" ascii wide nocase
        $alias_5 = "adware.qjwmonkey" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QJWMONKEY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qjwmonkey tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qjwmonkey"
        date = "2026-10-16"
    strings:
        $attrib_str = "qjwmonkey" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Qmlfrt0J91Kid (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qmlfrt0j91kid
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QMLFRT0J91KID_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qmlfrt0J91Kid (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qmlfrt0j91kid"
        date = "2026-10-16"
    strings:
        $fam_name = "qmlfrt0j91kid" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QMLFRT0J91KID_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qmlfrt0J91Kid tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qmlfrt0j91kid"
        date = "2026-10-16"
    strings:
        $attrib_str = "qmlfrt0j91kid" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Qmuabwpoobbg (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qmuabwpoobbg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QMUABWPOOBBG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qmuabwpoobbg (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qmuabwpoobbg"
        date = "2026-10-16"
    strings:
        $fam_name = "qmuabwpoobbg" ascii wide nocase
        $alias_1 = "trojan.qmuabwpoobbg" ascii wide nocase
        $alias_2 = "win32/trojan.obfuscated" ascii wide nocase
        $alias_3 = "suspicious.dga" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QMUABWPOOBBG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qmuabwpoobbg tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qmuabwpoobbg"
        date = "2026-10-16"
    strings:
        $attrib_str = "qmuabwpoobbg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Qqfarmassist (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qqfarmassist
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QQFARMASSIST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qqfarmassist (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqfarmassist"
        date = "2026-10-16"
    strings:
        $fam_name = "qqfarmassist" ascii wide nocase
        $alias_1 = "pup.qqfarmassist" ascii wide nocase
        $alias_2 = "riskware.cheattool" ascii wide nocase
        $alias_3 = "hacktool.qqfarm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QQFARMASSIST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qqfarmassist tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqfarmassist"
        date = "2026-10-16"
    strings:
        $attrib_str = "qqfarmassist" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Qqfarmer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qqfarmer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QQFARMER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qqfarmer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqfarmer"
        date = "2026-10-16"
    strings:
        $fam_name = "qqfarmer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QQFARMER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qqfarmer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqfarmer"
        date = "2026-10-16"
    strings:
        $attrib_str = "qqfarmer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Qqlogger (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qqlogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QQLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qqlogger (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqlogger"
        date = "2026-10-16"
    strings:
        $fam_name = "qqlogger" ascii wide nocase
        $alias_1 = "spyware:win32/qqlogger" ascii wide nocase
        $alias_2 = "trojan-spy:win32/qqlogger" ascii wide nocase
        $alias_3 = "pws:win32/qqlogger" ascii wide nocase
        $alias_4 = "win32/qqlogger" ascii wide nocase
        $alias_5 = "trojanspy:win32/qqpass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QQLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qqlogger tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqlogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "qqlogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Qqmima (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qqmima
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QQMIMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qqmima (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqmima"
        date = "2026-10-16"
    strings:
        $fam_name = "qqmima" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QQMIMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qqmima tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqmima"
        date = "2026-10-16"
    strings:
        $attrib_str = "qqmima" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Qqpass (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qqpass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QQPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qqpass (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqpass"
        date = "2026-10-16"
    strings:
        $fam_name = "qqpass" ascii wide nocase
        $alias_1 = "qqpass" ascii wide nocase
        $alias_2 = "trojan-psw.win32.qqpass" ascii wide nocase
        $alias_3 = "pws:win32/qqpass" ascii wide nocase
        $alias_4 = "psw.qqpass" ascii wide nocase
        $alias_5 = "win32/qqpass" ascii wide nocase
        $alias_6 = "trojan.qqpass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QQPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qqpass tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqpass"
        date = "2026-10-16"
    strings:
        $attrib_str = "qqpass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Qqrob (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qqrob
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QQROB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qqrob (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqrob"
        date = "2026-10-16"
    strings:
        $fam_name = "qqrob" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QQROB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qqrob tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqrob"
        date = "2026-10-16"
    strings:
        $attrib_str = "qqrob" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Qqshou (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qqshou
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QQSHOU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qqshou (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqshou"
        date = "2026-10-16"
    strings:
        $fam_name = "qqshou" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QQSHOU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qqshou tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqshou"
        date = "2026-10-16"
    strings:
        $attrib_str = "qqshou" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Qqspy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qqspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QQSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qqspy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqspy"
        date = "2026-10-16"
    strings:
        $fam_name = "qqspy" ascii wide nocase
        $alias_1 = "spyware.qqspy" ascii wide nocase
        $alias_2 = "trojan.pws.qqpass" ascii wide nocase
        $alias_3 = "win32/qqspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QQSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qqspy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "qqspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Qqten (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qqten
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QQTEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qqten (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqten"
        date = "2026-10-16"
    strings:
        $fam_name = "qqten" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QQTEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qqten tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqten"
        date = "2026-10-16"
    strings:
        $attrib_str = "qqten" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Qqware (Browser_Modifier)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qqware
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QQWARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qqware (Browser_Modifier)"
        category = "Browser_Modifier"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqware"
        date = "2026-10-16"
    strings:
        $fam_name = "qqware" ascii wide nocase
        $alias_1 = "browsermodifier:win32/qqware" ascii wide nocase
        $alias_2 = "adware:win32/qqware" ascii wide nocase
        $alias_3 = "pua:win32/qqware" ascii wide nocase
        $alias_4 = "qqware adware" ascii wide nocase
        $alias_5 = "win32/qqware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QQWARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qqware tradecraft"
        category = "Browser_Modifier"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qqware"
        date = "2026-10-16"
    strings:
        $attrib_str = "qqware" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Quant (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/quant
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QUANT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Quant (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quant"
        date = "2026-10-16"
    strings:
        $fam_name = "quant" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QUANT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Quant tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quant"
        date = "2026-10-16"
    strings:
        $attrib_str = "quant" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Quasar (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/quasar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QUASAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Quasar (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quasar"
        date = "2026-10-16"
    strings:
        $fam_name = "quasar" ascii wide nocase
        $alias_1 = "quasarrat" ascii wide nocase
        $alias_2 = "backdoor:msil/quasar" ascii wide nocase
        $alias_3 = "trojan.msil.quasar" ascii wide nocase
        $alias_4 = "win32/quasar.rat" ascii wide nocase
        $alias_5 = "quasar client" ascii wide nocase
        $alias_6 = "quasar remote administration tool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QUASAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Quasar tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quasar"
        date = "2026-10-16"
    strings:
        $attrib_str = "quasar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Quasarrat (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/quasarrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QUASARRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Quasarrat (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quasarrat"
        date = "2026-10-16"
    strings:
        $fam_name = "quasarrat" ascii wide nocase
        $alias_1 = "quasar rat" ascii wide nocase
        $alias_2 = "quasar" ascii wide nocase
        $alias_3 = "backdoor.msil.quasar" ascii wide nocase
        $alias_4 = "win32/quasar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QUASARRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Quasarrat tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quasarrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "quasarrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Quchispy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/quchispy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QUCHISPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Quchispy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quchispy"
        date = "2026-10-16"
    strings:
        $fam_name = "quchispy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QUCHISPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Quchispy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quchispy"
        date = "2026-10-16"
    strings:
        $attrib_str = "quchispy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Quervar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/quervar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QUERVAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Quervar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quervar"
        date = "2026-10-16"
    strings:
        $fam_name = "quervar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QUERVAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Quervar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quervar"
        date = "2026-10-16"
    strings:
        $attrib_str = "quervar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Quireap (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/quireap
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QUIREAP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Quireap (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quireap"
        date = "2026-10-16"
    strings:
        $fam_name = "quireap" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QUIREAP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Quireap tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/quireap"
        date = "2026-10-16"
    strings:
        $attrib_str = "quireap" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Qzonit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/qzonit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_QZONIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qzonit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qzonit"
        date = "2026-10-16"
    strings:
        $fam_name = "qzonit" ascii wide nocase
        $alias_1 = "ransom:win32/qzonit" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.qzonit" ascii wide nocase
        $alias_3 = "win32/qzonit" ascii wide nocase
        $alias_4 = "ransom.qzonit" ascii wide nocase
        $alias_5 = "ransom:win32/qzonit.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_QZONIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qzonit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/qzonit"
        date = "2026-10-16"
    strings:
        $attrib_str = "qzonit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rabased (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rabased
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RABASED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rabased (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rabased"
        date = "2026-10-16"
    strings:
        $fam_name = "rabased" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RABASED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rabased tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rabased"
        date = "2026-10-16"
    strings:
        $attrib_str = "rabased" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Radmin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/radmin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RADMIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Radmin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/radmin"
        date = "2026-10-16"
    strings:
        $fam_name = "radmin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RADMIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Radmin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/radmin"
        date = "2026-10-16"
    strings:
        $attrib_str = "radmin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ragua (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ragua
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RAGUA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ragua (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ragua"
        date = "2026-10-16"
    strings:
        $fam_name = "ragua" ascii wide nocase
        $alias_1 = "trojan.ragua" ascii wide nocase
        $alias_2 = "downloader.ragua" ascii wide nocase
        $alias_3 = "win32/ragua" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RAGUA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ragua tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ragua"
        date = "2026-10-16"
    strings:
        $attrib_str = "ragua" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rakhni (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rakhni
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RAKHNI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rakhni (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rakhni"
        date = "2026-10-16"
    strings:
        $fam_name = "rakhni" ascii wide nocase
        $alias_1 = "trojan-ransom.win32.rakhni" ascii wide nocase
        $alias_2 = "coinminer.rakhni" ascii wide nocase
        $alias_3 = "win32/rakhni" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RAKHNI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rakhni tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rakhni"
        date = "2026-10-16"
    strings:
        $attrib_str = "rakhni" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ramdo (Click_Fraud)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ramdo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RAMDO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ramdo (Click_Fraud)"
        category = "Click_Fraud"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ramdo"
        date = "2026-10-16"
    strings:
        $fam_name = "ramdo" ascii wide nocase
        $alias_1 = "trojan.ramdo" ascii wide nocase
        $alias_2 = "clickfraud.redyms" ascii wide nocase
        $alias_3 = "win32/ramdo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RAMDO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ramdo tradecraft"
        category = "Click_Fraud"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ramdo"
        date = "2026-10-16"
    strings:
        $attrib_str = "ramdo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ramnif (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ramnif
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RAMNIF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ramnif (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ramnif"
        date = "2026-10-16"
    strings:
        $fam_name = "ramnif" ascii wide nocase
        $alias_1 = "trojan.ramnit" ascii wide nocase
        $alias_2 = "worm.ramnif" ascii wide nocase
        $alias_3 = "win32/ramnit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RAMNIF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ramnif tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ramnif"
        date = "2026-10-16"
    strings:
        $attrib_str = "ramnif" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ramnit (Worm_Banker)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ramnit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RAMNIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ramnit (Worm_Banker)"
        category = "Worm_Banker"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ramnit"
        date = "2026-10-16"
    strings:
        $fam_name = "ramnit" ascii wide nocase
        $alias_1 = "ramnit" ascii wide nocase
        $alias_2 = "nimnul" ascii wide nocase
        $alias_3 = "cosmu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RAMNIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ramnit tradecraft"
        category = "Worm_Banker"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ramnit"
        date = "2026-10-16"
    strings:
        $attrib_str = "ramnit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ranapama (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ranapama
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANAPAMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ranapama (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranapama"
        date = "2026-10-16"
    strings:
        $fam_name = "ranapama" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANAPAMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ranapama tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranapama"
        date = "2026-10-16"
    strings:
        $attrib_str = "ranapama" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Randrew (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/randrew
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANDREW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Randrew (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/randrew"
        date = "2026-10-16"
    strings:
        $fam_name = "randrew" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANDREW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Randrew tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/randrew"
        date = "2026-10-16"
    strings:
        $attrib_str = "randrew" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ranion (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ranion
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANION_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ranion (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranion"
        date = "2026-10-16"
    strings:
        $fam_name = "ranion" ascii wide nocase
        $alias_1 = "trojan-ransom.win32.ranion" ascii wide nocase
        $alias_2 = "ransom.ranion" ascii wide nocase
        $alias_3 = "ranion raas" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANION_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ranion tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranion"
        date = "2026-10-16"
    strings:
        $attrib_str = "ranion" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ranna (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ranna
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANNA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ranna (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranna"
        date = "2026-10-16"
    strings:
        $fam_name = "ranna" ascii wide nocase
        $alias_1 = "trojan.ranna" ascii wide nocase
        $alias_2 = "downloader.ranna" ascii wide nocase
        $alias_3 = "win32/ranna" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANNA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ranna tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranna"
        date = "2026-10-16"
    strings:
        $attrib_str = "ranna" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ranos (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ranos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ranos (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranos"
        date = "2026-10-16"
    strings:
        $fam_name = "ranos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ranos tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranos"
        date = "2026-10-16"
    strings:
        $attrib_str = "ranos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ranpax (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ranpax
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANPAX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ranpax (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranpax"
        date = "2026-10-16"
    strings:
        $fam_name = "ranpax" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANPAX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ranpax tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranpax"
        date = "2026-10-16"
    strings:
        $attrib_str = "ranpax" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ranserkd (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ranserkd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANSERKD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ranserkd (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranserkd"
        date = "2026-10-16"
    strings:
        $fam_name = "ranserkd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANSERKD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ranserkd tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ranserkd"
        date = "2026-10-16"
    strings:
        $attrib_str = "ranserkd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ransim (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ransim
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANSIM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ransim (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ransim"
        date = "2026-10-16"
    strings:
        $fam_name = "ransim" ascii wide nocase
        $alias_1 = "hacktool.ransim" ascii wide nocase
        $alias_2 = "riskware.ransomwaresimulator" ascii wide nocase
        $alias_3 = "win32/ransim" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANSIM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ransim tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ransim"
        date = "2026-10-16"
    strings:
        $attrib_str = "ransim" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ransomheur (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ransomheur
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANSOMHEUR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ransomheur (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ransomheur"
        date = "2026-10-16"
    strings:
        $fam_name = "ransomheur" ascii wide nocase
        $alias_1 = "generic.ransom.heur" ascii wide nocase
        $alias_2 = "heur:trojan-ransom" ascii wide nocase
        $alias_3 = "suspicious.ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANSOMHEUR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ransomheur tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ransomheur"
        date = "2026-10-16"
    strings:
        $attrib_str = "ransomheur" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ransomkd (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ransomkd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANSOMKD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ransomkd (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ransomkd"
        date = "2026-10-16"
    strings:
        $fam_name = "ransomkd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANSOMKD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ransomkd tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ransomkd"
        date = "2026-10-16"
    strings:
        $attrib_str = "ransomkd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rantest (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rantest
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RANTEST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rantest (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rantest"
        date = "2026-10-16"
    strings:
        $fam_name = "rantest" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RANTEST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rantest tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rantest"
        date = "2026-10-16"
    strings:
        $attrib_str = "rantest" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rapid (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rapid
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RAPID_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rapid (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rapid"
        date = "2026-10-16"
    strings:
        $fam_name = "rapid" ascii wide nocase
        $alias_1 = "ransom:win32/rapid" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.rapid" ascii wide nocase
        $alias_3 = "win32/rapid" ascii wide nocase
        $alias_4 = "ransom.rapid" ascii wide nocase
        $alias_5 = "rapid ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RAPID_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rapid tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rapid"
        date = "2026-10-16"
    strings:
        $attrib_str = "rapid" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rapidpass (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rapidpass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RAPIDPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rapidpass (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rapidpass"
        date = "2026-10-16"
    strings:
        $fam_name = "rapidpass" ascii wide nocase
        $alias_1 = "trojan.rapidpass" ascii wide nocase
        $alias_2 = "downloader.rapidpass" ascii wide nocase
        $alias_3 = "win32/rapidpass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RAPIDPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rapidpass tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rapidpass"
        date = "2026-10-16"
    strings:
        $attrib_str = "rapidpass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rapkill (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rapkill
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RAPKILL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rapkill (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rapkill"
        date = "2026-10-16"
    strings:
        $fam_name = "rapkill" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RAPKILL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rapkill tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rapkill"
        date = "2026-10-16"
    strings:
        $attrib_str = "rapkill" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rarmal (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rarmal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RARMAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rarmal (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rarmal"
        date = "2026-10-16"
    strings:
        $fam_name = "rarmal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RARMAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rarmal tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rarmal"
        date = "2026-10-16"
    strings:
        $attrib_str = "rarmal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rasch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rasch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RASCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rasch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rasch"
        date = "2026-10-16"
    strings:
        $fam_name = "rasch" ascii wide nocase
        $alias_1 = "trojan.rasch" ascii wide nocase
        $alias_2 = "downloader.rasch" ascii wide nocase
        $alias_3 = "win32/rasch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RASCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rasch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rasch"
        date = "2026-10-16"
    strings:
        $attrib_str = "rasch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rasftuby (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rasftuby
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RASFTUBY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rasftuby (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rasftuby"
        date = "2026-10-16"
    strings:
        $fam_name = "rasftuby" ascii wide nocase
        $alias_1 = "ransom:win32/rasftuby" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.rasftuby" ascii wide nocase
        $alias_3 = "trojan.rasftuby" ascii wide nocase
        $alias_4 = "win32/rasftuby" ascii wide nocase
        $alias_5 = "ransom:win32/rasftuby.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RASFTUBY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rasftuby tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rasftuby"
        date = "2026-10-16"
    strings:
        $attrib_str = "rasftuby" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rasoon (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rasoon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RASOON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rasoon (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rasoon"
        date = "2026-10-16"
    strings:
        $fam_name = "rasoon" ascii wide nocase
        $alias_1 = "trojan.rasoon" ascii wide nocase
        $alias_2 = "pws.rasoon" ascii wide nocase
        $alias_3 = "trojanspy.rasoon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RASOON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rasoon tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rasoon"
        date = "2026-10-16"
    strings:
        $attrib_str = "rasoon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Rastabaf (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rastabaf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RASTABAF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rastabaf (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rastabaf"
        date = "2026-10-16"
    strings:
        $fam_name = "rastabaf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RASTABAF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rastabaf tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rastabaf"
        date = "2026-10-16"
    strings:
        $attrib_str = "rastabaf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rastarby (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rastarby
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RASTARBY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rastarby (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rastarby"
        date = "2026-10-16"
    strings:
        $fam_name = "rastarby" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RASTARBY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rastarby tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rastarby"
        date = "2026-10-16"
    strings:
        $attrib_str = "rastarby" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ravs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ravs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RAVS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ravs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ravs"
        date = "2026-10-16"
    strings:
        $fam_name = "ravs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RAVS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ravs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ravs"
        date = "2026-10-16"
    strings:
        $attrib_str = "ravs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Razy (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/razy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RAZY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Razy (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/razy"
        date = "2026-10-16"
    strings:
        $fam_name = "razy" ascii wide nocase
        $alias_1 = "trojan:win32/razy" ascii wide nocase
        $alias_2 = "trojan.win32.razy" ascii wide nocase
        $alias_3 = "trojan.razy.gen" ascii wide nocase
        $alias_4 = "win32/razy.stealer" ascii wide nocase
        $alias_5 = "trojan.razy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RAZY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Razy tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/razy"
        date = "2026-10-16"
    strings:
        $attrib_str = "razy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Rbot (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rbot (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rbot"
        date = "2026-10-16"
    strings:
        $fam_name = "rbot" ascii wide nocase
        $alias_1 = "backdoor:win32/rbot" ascii wide nocase
        $alias_2 = "w32.spybot" ascii wide nocase
        $alias_3 = "worm:win32/rbot" ascii wide nocase
        $alias_4 = "trojan.win32.rbot" ascii wide nocase
        $alias_5 = "win32/rbot" ascii wide nocase
        $alias_6 = "rxbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rbot tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "rbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Realspy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/realspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REALSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Realspy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/realspy"
        date = "2026-10-16"
    strings:
        $fam_name = "realspy" ascii wide nocase
        $alias_1 = "riskware.realspy" ascii wide nocase
        $alias_2 = "keylogger.realspy" ascii wide nocase
        $alias_3 = "monitor.realspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REALSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Realspy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/realspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "realspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rebhip (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rebhip
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REBHIP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rebhip (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rebhip"
        date = "2026-10-16"
    strings:
        $fam_name = "rebhip" ascii wide nocase
        $alias_1 = "rebhip" ascii wide nocase
        $alias_2 = "worm:win32/rebhip" ascii wide nocase
        $alias_3 = "w32/rebhip" ascii wide nocase
        $alias_4 = "trojan.rebhip" ascii wide nocase
        $alias_5 = "worm.win32.rebhip" ascii wide nocase
        $alias_6 = "rebhip.a" ascii wide nocase
        $alias_7 = "rebhip.b" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REBHIP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rebhip tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rebhip"
        date = "2026-10-16"
    strings:
        $attrib_str = "rebhip" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Recam (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/recam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RECAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Recam (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/recam"
        date = "2026-10-16"
    strings:
        $fam_name = "recam" ascii wide nocase
        $alias_1 = "backdoor:win32/recam" ascii wide nocase
        $alias_2 = "trojan:win32/recam" ascii wide nocase
        $alias_3 = "win32/recam" ascii wide nocase
        $alias_4 = "backdoor.recam" ascii wide nocase
        $alias_5 = "backdoor:win32/recam.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RECAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Recam tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/recam"
        date = "2026-10-16"
    strings:
        $attrib_str = "recam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Recex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/recex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RECEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Recex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/recex"
        date = "2026-10-16"
    strings:
        $fam_name = "recex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RECEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Recex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/recex"
        date = "2026-10-16"
    strings:
        $attrib_str = "recex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Reconyc (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/reconyc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RECONYC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Reconyc (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reconyc"
        date = "2026-10-16"
    strings:
        $fam_name = "reconyc" ascii wide nocase
        $alias_1 = "trojan:win32/reconyc" ascii wide nocase
        $alias_2 = "trojan.win32.reconyc" ascii wide nocase
        $alias_3 = "trojan.reconyc" ascii wide nocase
        $alias_4 = "win32/reconyc.a" ascii wide nocase
        $alias_5 = "reconyc dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RECONYC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Reconyc tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reconyc"
        date = "2026-10-16"
    strings:
        $attrib_str = "reconyc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Recory (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/recory
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RECORY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Recory (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/recory"
        date = "2026-10-16"
    strings:
        $fam_name = "recory" ascii wide nocase
        $alias_1 = "fakeav.recory" ascii wide nocase
        $alias_2 = "ransom.recory" ascii wide nocase
        $alias_3 = "scareware.win32/recory" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RECORY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Recory tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/recory"
        date = "2026-10-16"
    strings:
        $attrib_str = "recory" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Redaman (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redaman
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDAMAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redaman (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redaman"
        date = "2026-10-16"
    strings:
        $fam_name = "redaman" ascii wide nocase
        $alias_1 = "trojan-banker.win32.redaman" ascii wide nocase
        $alias_2 = "banker.rtm" ascii wide nocase
        $alias_3 = "win32/redaman" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDAMAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redaman tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redaman"
        date = "2026-10-16"
    strings:
        $attrib_str = "redaman" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Redator (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redator (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redator"
        date = "2026-10-16"
    strings:
        $fam_name = "redator" ascii wide nocase
        $alias_1 = "trojan.redator" ascii wide nocase
        $alias_2 = "passwordstealer.redator" ascii wide nocase
        $alias_3 = "win32/redator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redator tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redator"
        date = "2026-10-16"
    strings:
        $attrib_str = "redator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Redcap (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redcap
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDCAP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redcap (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redcap"
        date = "2026-10-16"
    strings:
        $fam_name = "redcap" ascii wide nocase
        $alias_1 = "backdoor:win32/redcap" ascii wide nocase
        $alias_2 = "trojan:win32/redcap" ascii wide nocase
        $alias_3 = "backdoor.redcap" ascii wide nocase
        $alias_4 = "win32/redcap" ascii wide nocase
        $alias_5 = "backdoor:win32/redcap.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDCAP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redcap tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redcap"
        date = "2026-10-16"
    strings:
        $attrib_str = "redcap" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Redeye (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redeye
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDEYE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redeye (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redeye"
        date = "2026-10-16"
    strings:
        $fam_name = "redeye" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDEYE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redeye tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redeye"
        date = "2026-10-16"
    strings:
        $attrib_str = "redeye" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Redgirl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redgirl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDGIRL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redgirl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redgirl"
        date = "2026-10-16"
    strings:
        $fam_name = "redgirl" ascii wide nocase
        $alias_1 = "trojan.redgirl" ascii wide nocase
        $alias_2 = "downloader.redgirl" ascii wide nocase
        $alias_3 = "win32/redgirl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDGIRL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redgirl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redgirl"
        date = "2026-10-16"
    strings:
        $attrib_str = "redgirl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Redirect (Browser_Modifier)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redirect
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDIRECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redirect (Browser_Modifier)"
        category = "Browser_Modifier"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redirect"
        date = "2026-10-16"
    strings:
        $fam_name = "redirect" ascii wide nocase
        $alias_1 = "browsermodifier:win32/redirect" ascii wide nocase
        $alias_2 = "adware:win32/redirect" ascii wide nocase
        $alias_3 = "win32/redirect" ascii wide nocase
        $alias_4 = "redirect hijacker" ascii wide nocase
        $alias_5 = "trojan.browsermodifier.redirect" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDIRECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redirect tradecraft"
        category = "Browser_Modifier"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redirect"
        date = "2026-10-16"
    strings:
        $attrib_str = "redirect" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Redirected (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redirected
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDIRECTED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redirected (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redirected"
        date = "2026-10-16"
    strings:
        $fam_name = "redirected" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDIRECTED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redirected tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redirected"
        date = "2026-10-16"
    strings:
        $attrib_str = "redirected" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Redlonam (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redlonam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDLONAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redlonam (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redlonam"
        date = "2026-10-16"
    strings:
        $fam_name = "redlonam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDLONAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redlonam tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redlonam"
        date = "2026-10-16"
    strings:
        $attrib_str = "redlonam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Redneck (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redneck
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDNECK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redneck (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redneck"
        date = "2026-10-16"
    strings:
        $fam_name = "redneck" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDNECK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redneck tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redneck"
        date = "2026-10-16"
    strings:
        $attrib_str = "redneck" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Redosdru (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redosdru
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDOSDRU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redosdru (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redosdru"
        date = "2026-10-16"
    strings:
        $fam_name = "redosdru" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDOSDRU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redosdru tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redosdru"
        date = "2026-10-16"
    strings:
        $attrib_str = "redosdru" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Redsip (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redsip
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDSIP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redsip (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redsip"
        date = "2026-10-16"
    strings:
        $fam_name = "redsip" ascii wide nocase
        $alias_1 = "trojan.redsip" ascii wide nocase
        $alias_2 = "spyware.sip" ascii wide nocase
        $alias_3 = "backdoor.redsip" ascii wide nocase
        $alias_4 = "tollfraud.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDSIP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redsip tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redsip"
        date = "2026-10-16"
    strings:
        $attrib_str = "redsip" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Redyms (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redyms
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDYMS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redyms (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redyms"
        date = "2026-10-16"
    strings:
        $fam_name = "redyms" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDYMS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redyms tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redyms"
        date = "2026-10-16"
    strings:
        $attrib_str = "redyms" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Refinka (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/refinka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REFINKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Refinka (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/refinka"
        date = "2026-10-16"
    strings:
        $fam_name = "refinka" ascii wide nocase
        $alias_1 = "ransom:win32/refinka" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.refinka" ascii wide nocase
        $alias_3 = "trojan.refinka" ascii wide nocase
        $alias_4 = "win32/refinka" ascii wide nocase
        $alias_5 = "ransom:win32/refinka.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REFINKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Refinka tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/refinka"
        date = "2026-10-16"
    strings:
        $attrib_str = "refinka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Refog (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/refog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REFOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Refog (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/refog"
        date = "2026-10-16"
    strings:
        $fam_name = "refog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REFOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Refog tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/refog"
        date = "2026-10-16"
    strings:
        $attrib_str = "refog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Refogkeylogging (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/refogkeylogging
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REFOGKEYLOGGING_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Refogkeylogging (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/refogkeylogging"
        date = "2026-10-16"
    strings:
        $fam_name = "refogkeylogging" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REFOGKEYLOGGING_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Refogkeylogging tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/refogkeylogging"
        date = "2026-10-16"
    strings:
        $attrib_str = "refogkeylogging" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Refpron (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/refpron
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REFPRON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Refpron (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/refpron"
        date = "2026-10-16"
    strings:
        $fam_name = "refpron" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REFPRON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Refpron tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/refpron"
        date = "2026-10-16"
    strings:
        $attrib_str = "refpron" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Refroso (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/refroso
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REFROSO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Refroso (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/refroso"
        date = "2026-10-16"
    strings:
        $fam_name = "refroso" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REFROSO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Refroso tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/refroso"
        date = "2026-10-16"
    strings:
        $attrib_str = "refroso" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Regcure (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/regcure
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REGCURE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Regcure (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regcure"
        date = "2026-10-16"
    strings:
        $fam_name = "regcure" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REGCURE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Regcure tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regcure"
        date = "2026-10-16"
    strings:
        $attrib_str = "regcure" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Regcurepro (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/regcurepro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REGCUREPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Regcurepro (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regcurepro"
        date = "2026-10-16"
    strings:
        $fam_name = "regcurepro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REGCUREPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Regcurepro tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regcurepro"
        date = "2026-10-16"
    strings:
        $attrib_str = "regcurepro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Regger (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/regger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Regger (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regger"
        date = "2026-10-16"
    strings:
        $fam_name = "regger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Regger tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regger"
        date = "2026-10-16"
    strings:
        $attrib_str = "regger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Regrun (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/regrun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REGRUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Regrun (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regrun"
        date = "2026-10-16"
    strings:
        $fam_name = "regrun" ascii wide nocase
        $alias_1 = "trojan:win32/regrun" ascii wide nocase
        $alias_2 = "trojan.win32.regrun" ascii wide nocase
        $alias_3 = "win32/regrun" ascii wide nocase
        $alias_4 = "regrun trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REGRUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Regrun tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regrun"
        date = "2026-10-16"
    strings:
        $attrib_str = "regrun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Regsup (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/regsup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REGSUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Regsup (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regsup"
        date = "2026-10-16"
    strings:
        $fam_name = "regsup" ascii wide nocase
        $alias_1 = "trojan:win32/regsup" ascii wide nocase
        $alias_2 = "pua:win32/regsup" ascii wide nocase
        $alias_3 = "trojan.win32.regsup" ascii wide nocase
        $alias_4 = "win32/regsup.a" ascii wide nocase
        $alias_5 = "trojan.regsup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REGSUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Regsup tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regsup"
        date = "2026-10-16"
    strings:
        $attrib_str = "regsup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Regub (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/regub
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REGUB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Regub (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regub"
        date = "2026-10-16"
    strings:
        $fam_name = "regub" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REGUB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Regub tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/regub"
        date = "2026-10-16"
    strings:
        $attrib_str = "regub" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Reimage (Rogue)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/reimage
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REIMAGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Reimage (Rogue)"
        category = "Rogue"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reimage"
        date = "2026-10-16"
    strings:
        $fam_name = "reimage" ascii wide nocase
        $alias_1 = "pua:win32/reimage" ascii wide nocase
        $alias_2 = "program:win32/reimagerepair" ascii wide nocase
        $alias_3 = "rogue:win32/reimage" ascii wide nocase
        $alias_4 = "win32/reimage" ascii wide nocase
        $alias_5 = "reimage repair" ascii wide nocase
        $alias_6 = "pua.reimage" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REIMAGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Reimage tradecraft"
        category = "Rogue"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reimage"
        date = "2026-10-16"
    strings:
        $attrib_str = "reimage" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Relevantknowledge (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/relevantknowledge
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RELEVANTKNOWLEDGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Relevantknowledge (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/relevantknowledge"
        date = "2026-10-16"
    strings:
        $fam_name = "relevantknowledge" ascii wide nocase
        $alias_1 = "spyware:win32/relevantknowledge" ascii wide nocase
        $alias_2 = "adware:win32/relevantknowledge" ascii wide nocase
        $alias_3 = "pua.win32.relevantknowledge" ascii wide nocase
        $alias_4 = "adw_releknow" ascii wide nocase
        $alias_5 = "tmrg relevantknowledge" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RELEVANTKNOWLEDGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Relevantknowledge tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/relevantknowledge"
        date = "2026-10-16"
    strings:
        $attrib_str = "relevantknowledge" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Remas (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/remas
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REMAS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Remas (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remas"
        date = "2026-10-16"
    strings:
        $fam_name = "remas" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REMAS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Remas tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remas"
        date = "2026-10-16"
    strings:
        $attrib_str = "remas" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Remcos (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/remcos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REMCOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Remcos (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remcos"
        date = "2026-10-16"
    strings:
        $fam_name = "remcos" ascii wide nocase
        $alias_1 = "remcos" ascii wide nocase
        $alias_2 = "remcos rat" ascii wide nocase
        $alias_3 = "remcosrat" ascii wide nocase
        $alias_4 = "backdoor.win32.remcos" ascii wide nocase
        $alias_5 = "rat.remcos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REMCOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Remcos tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remcos"
        date = "2026-10-16"
    strings:
        $attrib_str = "remcos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Remexi (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/remexi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REMEXI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Remexi (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remexi"
        date = "2026-10-16"
    strings:
        $fam_name = "remexi" ascii wide nocase
        $alias_1 = "backdoor.remexi" ascii wide nocase
        $alias_2 = "trojan.remexi" ascii wide nocase
        $alias_3 = "apt.chafer" ascii wide nocase
        $alias_4 = "apt39" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REMEXI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Remexi tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remexi"
        date = "2026-10-16"
    strings:
        $attrib_str = "remexi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Remoh (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/remoh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REMOH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Remoh (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remoh"
        date = "2026-10-16"
    strings:
        $fam_name = "remoh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REMOH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Remoh tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remoh"
        date = "2026-10-16"
    strings:
        $attrib_str = "remoh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Remote (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/remote
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REMOTE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Remote (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remote"
        date = "2026-10-16"
    strings:
        $fam_name = "remote" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REMOTE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Remote tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remote"
        date = "2026-10-16"
    strings:
        $attrib_str = "remote" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Remoteadmin (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/remoteadmin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REMOTEADMIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Remoteadmin (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remoteadmin"
        date = "2026-10-16"
    strings:
        $fam_name = "remoteadmin" ascii wide nocase
        $alias_1 = "riskware:win32/remoteadmin" ascii wide nocase
        $alias_2 = "hacktool:win32/remoteadmin" ascii wide nocase
        $alias_3 = "win32/remoteadmin" ascii wide nocase
        $alias_4 = "hacktool:win32/remoteadmin!msr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REMOTEADMIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Remoteadmin tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remoteadmin"
        date = "2026-10-16"
    strings:
        $attrib_str = "remoteadmin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Remotehack (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/remotehack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REMOTEHACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Remotehack (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remotehack"
        date = "2026-10-16"
    strings:
        $fam_name = "remotehack" ascii wide nocase
        $alias_1 = "hacktool.remotehack" ascii wide nocase
        $alias_2 = "rat.remotehack" ascii wide nocase
        $alias_3 = "win32/remotehack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REMOTEHACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Remotehack tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remotehack"
        date = "2026-10-16"
    strings:
        $attrib_str = "remotehack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Remotemanipulator (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/remotemanipulator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REMOTEMANIPULATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Remotemanipulator (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remotemanipulator"
        date = "2026-10-16"
    strings:
        $fam_name = "remotemanipulator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REMOTEMANIPULATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Remotemanipulator tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remotemanipulator"
        date = "2026-10-16"
    strings:
        $attrib_str = "remotemanipulator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Removewga (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/removewga
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REMOVEWGA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Removewga (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/removewga"
        date = "2026-10-16"
    strings:
        $fam_name = "removewga" ascii wide nocase
        $alias_1 = "hacktool.removewga" ascii wide nocase
        $alias_2 = "riskware.wga" ascii wide nocase
        $alias_3 = "win32/removewga" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REMOVEWGA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Removewga tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/removewga"
        date = "2026-10-16"
    strings:
        $attrib_str = "removewga" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Remoxec (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/remoxec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REMOXEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Remoxec (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remoxec"
        date = "2026-10-16"
    strings:
        $fam_name = "remoxec" ascii wide nocase
        $alias_1 = "backdoor.remoxec" ascii wide nocase
        $alias_2 = "rat.remoxec" ascii wide nocase
        $alias_3 = "win32/remoxec" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REMOXEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Remoxec tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/remoxec"
        date = "2026-10-16"
    strings:
        $attrib_str = "remoxec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Renaz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/renaz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RENAZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Renaz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/renaz"
        date = "2026-10-16"
    strings:
        $fam_name = "renaz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RENAZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Renaz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/renaz"
        date = "2026-10-16"
    strings:
        $attrib_str = "renaz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Renos (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/renos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RENOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Renos (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/renos"
        date = "2026-10-16"
    strings:
        $fam_name = "renos" ascii wide nocase
        $alias_1 = "trojandownloader:win32/renos" ascii wide nocase
        $alias_2 = "trojan.renos" ascii wide nocase
        $alias_3 = "trojan-downloader.win32.renos" ascii wide nocase
        $alias_4 = "win32/renos" ascii wide nocase
        $alias_5 = "fakespypro downloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RENOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Renos tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/renos"
        date = "2026-10-16"
    strings:
        $attrib_str = "renos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Reposfxg (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/reposfxg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REPOSFXG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Reposfxg (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reposfxg"
        date = "2026-10-16"
    strings:
        $fam_name = "reposfxg" ascii wide nocase
        $alias_1 = "trojan.reposfxg" ascii wide nocase
        $alias_2 = "downloader.reposfxg" ascii wide nocase
        $alias_3 = "win32/reposfxg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REPOSFXG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Reposfxg tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reposfxg"
        date = "2026-10-16"
    strings:
        $attrib_str = "reposfxg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Reptile (Rootkit)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/reptile
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REPTILE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Reptile (Rootkit)"
        category = "Rootkit"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reptile"
        date = "2026-10-16"
    strings:
        $fam_name = "reptile" ascii wide nocase
        $alias_1 = "rootkit:linux/reptile" ascii wide nocase
        $alias_2 = "backdoor:linux/reptile" ascii wide nocase
        $alias_3 = "rootkit:win32/reptile" ascii wide nocase
        $alias_4 = "reptile lkm rootkit" ascii wide nocase
        $alias_5 = "reptile framework" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REPTILE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Reptile tradecraft"
        category = "Rootkit"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reptile"
        date = "2026-10-16"
    strings:
        $attrib_str = "reptile" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rescoms (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rescoms
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RESCOMS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rescoms (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rescoms"
        date = "2026-10-16"
    strings:
        $fam_name = "rescoms" ascii wide nocase
        $alias_1 = "backdoor:win32/rescoms" ascii wide nocase
        $alias_2 = "trojan:win32/remcos" ascii wide nocase
        $alias_3 = "backdoor.remcos" ascii wide nocase
        $alias_4 = "win32/remcos" ascii wide nocase
        $alias_5 = "remcos rat" ascii wide nocase
        $alias_6 = "backdoor:win32/remcos.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RESCOMS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rescoms tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rescoms"
        date = "2026-10-16"
    strings:
        $attrib_str = "rescoms" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Resdro (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/resdro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RESDRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Resdro (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/resdro"
        date = "2026-10-16"
    strings:
        $fam_name = "resdro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RESDRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Resdro tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/resdro"
        date = "2026-10-16"
    strings:
        $attrib_str = "resdro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Reset (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/reset
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RESET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Reset (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reset"
        date = "2026-10-16"
    strings:
        $fam_name = "reset" ascii wide nocase
        $alias_1 = "ransom:win32/reset" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.reset" ascii wide nocase
        $alias_3 = "win32/reset" ascii wide nocase
        $alias_4 = "reset ransomware" ascii wide nocase
        $alias_5 = "ransom.reset" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RESET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Reset tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reset"
        date = "2026-10-16"
    strings:
        $attrib_str = "reset" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Resod (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/resod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RESOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Resod (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/resod"
        date = "2026-10-16"
    strings:
        $fam_name = "resod" ascii wide nocase
        $alias_1 = "ransom:win32/resod" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.resod" ascii wide nocase
        $alias_3 = "win32/resod" ascii wide nocase
        $alias_4 = "ransom.resod" ascii wide nocase
        $alias_5 = "resod ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RESOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Resod tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/resod"
        date = "2026-10-16"
    strings:
        $attrib_str = "resod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Restoro (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/restoro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RESTORO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Restoro (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/restoro"
        date = "2026-10-16"
    strings:
        $fam_name = "restoro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RESTORO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Restoro tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/restoro"
        date = "2026-10-16"
    strings:
        $attrib_str = "restoro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Resur (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/resur
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RESUR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Resur (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/resur"
        date = "2026-10-16"
    strings:
        $fam_name = "resur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RESUR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Resur tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/resur"
        date = "2026-10-16"
    strings:
        $attrib_str = "resur" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Retefe (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/retefe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RETEFE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Retefe (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/retefe"
        date = "2026-10-16"
    strings:
        $fam_name = "retefe" ascii wide nocase
        $alias_1 = "trojan:win32/retefe" ascii wide nocase
        $alias_2 = "trojan-banker.win32.retefe" ascii wide nocase
        $alias_3 = "win32/retefe" ascii wide nocase
        $alias_4 = "retefe banking trojan" ascii wide nocase
        $alias_5 = "retefe proxy trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RETEFE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Retefe tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/retefe"
        date = "2026-10-16"
    strings:
        $attrib_str = "retefe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Retribution (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/retribution
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RETRIBUTION_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Retribution (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/retribution"
        date = "2026-10-16"
    strings:
        $fam_name = "retribution" ascii wide nocase
        $alias_1 = "trojan-ransom.win32.retribution" ascii wide nocase
        $alias_2 = "ransom:win32/retribution" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RETRIBUTION_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Retribution tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/retribution"
        date = "2026-10-16"
    strings:
        $attrib_str = "retribution" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Revealerkeylogger (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/revealerkeylogger
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REVEALERKEYLOGGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Revealerkeylogger (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revealerkeylogger"
        date = "2026-10-16"
    strings:
        $fam_name = "revealerkeylogger" ascii wide nocase
        $alias_1 = "riskware.revealerkeylogger" ascii wide nocase
        $alias_2 = "hacktool.keylogger" ascii wide nocase
        $alias_3 = "spyware.revealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REVEALERKEYLOGGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Revealerkeylogger tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revealerkeylogger"
        date = "2026-10-16"
    strings:
        $attrib_str = "revealerkeylogger" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Revenge (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/revenge
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REVENGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Revenge (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revenge"
        date = "2026-10-16"
    strings:
        $fam_name = "revenge" ascii wide nocase
        $alias_1 = "backdoor:win32/revenge" ascii wide nocase
        $alias_2 = "backdoor:msil/revengerat" ascii wide nocase
        $alias_3 = "revengerat" ascii wide nocase
        $alias_4 = "win32/revenge" ascii wide nocase
        $alias_5 = "trojan:msil/revengerat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REVENGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Revenge tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revenge"
        date = "2026-10-16"
    strings:
        $attrib_str = "revenge" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Revengerat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/revengerat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REVENGERAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Revengerat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revengerat"
        date = "2026-10-16"
    strings:
        $fam_name = "revengerat" ascii wide nocase
        $alias_1 = "backdoor.revengerat" ascii wide nocase
        $alias_2 = "trojan.revenge" ascii wide nocase
        $alias_3 = "win32/revengerat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REVENGERAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Revengerat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revengerat"
        date = "2026-10-16"
    strings:
        $attrib_str = "revengerat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Reveton (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/reveton
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REVETON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Reveton (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reveton"
        date = "2026-10-16"
    strings:
        $fam_name = "reveton" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REVETON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Reveton tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reveton"
        date = "2026-10-16"
    strings:
        $attrib_str = "reveton" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Revetrat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/revetrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REVETRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Revetrat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revetrat"
        date = "2026-10-16"
    strings:
        $fam_name = "revetrat" ascii wide nocase
        $alias_1 = "backdoor:win32/revengerat" ascii wide nocase
        $alias_2 = "trojan:win32/revetrat" ascii wide nocase
        $alias_3 = "msil/revengerat" ascii wide nocase
        $alias_4 = "revenge rat" ascii wide nocase
        $alias_5 = "win32/revengerat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REVETRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Revetrat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revetrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "revetrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Revizer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/revizer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REVIZER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Revizer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revizer"
        date = "2026-10-16"
    strings:
        $fam_name = "revizer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REVIZER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Revizer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revizer"
        date = "2026-10-16"
    strings:
        $attrib_str = "revizer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rewriteboota (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rewriteboota
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REWRITEBOOTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rewriteboota (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rewriteboota"
        date = "2026-10-16"
    strings:
        $fam_name = "rewriteboota" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REWRITEBOOTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rewriteboota tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rewriteboota"
        date = "2026-10-16"
    strings:
        $attrib_str = "rewriteboota" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Reymbz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/reymbz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REYMBZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Reymbz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reymbz"
        date = "2026-10-16"
    strings:
        $fam_name = "reymbz" ascii wide nocase
        $alias_1 = "trojan.reymbz" ascii wide nocase
        $alias_2 = "downloader.reymbz" ascii wide nocase
        $alias_3 = "win32/reymbz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REYMBZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Reymbz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reymbz"
        date = "2026-10-16"
    strings:
        $attrib_str = "reymbz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Reyptson (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/reyptson
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REYPTSON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Reyptson (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reyptson"
        date = "2026-10-16"
    strings:
        $fam_name = "reyptson" ascii wide nocase
        $alias_1 = "trojan.reyptson" ascii wide nocase
        $alias_2 = "downloader.reyptson" ascii wide nocase
        $alias_3 = "win32/reyptson" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REYPTSON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Reyptson tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/reyptson"
        date = "2026-10-16"
    strings:
        $attrib_str = "reyptson" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rialega (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rialega
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RIALEGA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rialega (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rialega"
        date = "2026-10-16"
    strings:
        $fam_name = "rialega" ascii wide nocase
        $alias_1 = "trojan.rialega" ascii wide nocase
        $alias_2 = "downloader.rialega" ascii wide nocase
        $alias_3 = "win32/rialega" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RIALEGA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rialega tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rialega"
        date = "2026-10-16"
    strings:
        $attrib_str = "rialega" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ribaj (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ribaj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RIBAJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ribaj (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ribaj"
        date = "2026-10-16"
    strings:
        $fam_name = "ribaj" ascii wide nocase
        $alias_1 = "ribaj" ascii wide nocase
        $alias_2 = "trojan:win32/ribaj" ascii wide nocase
        $alias_3 = "trojan:msil/ribaj" ascii wide nocase
        $alias_4 = "win32/ribaj" ascii wide nocase
        $alias_5 = "trojan.ribaj" ascii wide nocase
        $alias_6 = "ribaj stealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RIBAJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ribaj tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ribaj"
        date = "2026-10-16"
    strings:
        $attrib_str = "ribaj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ridapi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ridapi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RIDAPI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ridapi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ridapi"
        date = "2026-10-16"
    strings:
        $fam_name = "ridapi" ascii wide nocase
        $alias_1 = "adware.ridapi" ascii wide nocase
        $alias_2 = "pup.ridapi" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RIDAPI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ridapi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ridapi"
        date = "2026-10-16"
    strings:
        $attrib_str = "ridapi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ridnu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ridnu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RIDNU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ridnu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ridnu"
        date = "2026-10-16"
    strings:
        $fam_name = "ridnu" ascii wide nocase
        $alias_1 = "trojan.ridnu" ascii wide nocase
        $alias_2 = "downloader.ridnu" ascii wide nocase
        $alias_3 = "win32/ridnu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RIDNU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ridnu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ridnu"
        date = "2026-10-16"
    strings:
        $attrib_str = "ridnu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rietspoof (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rietspoof
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RIETSPOOF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rietspoof (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rietspoof"
        date = "2026-10-16"
    strings:
        $fam_name = "rietspoof" ascii wide nocase
        $alias_1 = "trojan.rietspoof" ascii wide nocase
        $alias_2 = "loader.rietspoof" ascii wide nocase
        $alias_3 = "win32/rietspoof" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RIETSPOOF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rietspoof tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rietspoof"
        date = "2026-10-16"
    strings:
        $attrib_str = "rietspoof" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rifbu (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rifbu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RIFBU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rifbu (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rifbu"
        date = "2026-10-16"
    strings:
        $fam_name = "rifbu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RIFBU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rifbu tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rifbu"
        date = "2026-10-16"
    strings:
        $attrib_str = "rifbu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rifdoor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rifdoor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RIFDOOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rifdoor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rifdoor"
        date = "2026-10-16"
    strings:
        $fam_name = "rifdoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RIFDOOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rifdoor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rifdoor"
        date = "2026-10-16"
    strings:
        $attrib_str = "rifdoor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rimic (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rimic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RIMIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rimic (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rimic"
        date = "2026-10-16"
    strings:
        $fam_name = "rimic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RIMIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rimic tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rimic"
        date = "2026-10-16"
    strings:
        $attrib_str = "rimic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Riodrv (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/riodrv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RIODRV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Riodrv (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/riodrv"
        date = "2026-10-16"
    strings:
        $fam_name = "riodrv" ascii wide nocase
        $alias_1 = "rootkit.riodrv" ascii wide nocase
        $alias_2 = "win32/sony.rootkit" ascii wide nocase
        $alias_3 = "rootkit.win32.agent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RIODRV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Riodrv tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/riodrv"
        date = "2026-10-16"
    strings:
        $attrib_str = "riodrv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Rising (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rising
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RISING_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rising (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rising"
        date = "2026-10-16"
    strings:
        $fam_name = "rising" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RISING_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rising tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rising"
        date = "2026-10-16"
    strings:
        $attrib_str = "rising" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rkit (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rkit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RKIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rkit (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rkit"
        date = "2026-10-16"
    strings:
        $fam_name = "rkit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RKIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rkit tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rkit"
        date = "2026-10-16"
    strings:
        $attrib_str = "rkit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Rmkef9Zs0Zhi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rmkef9zs0zhi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RMKEF9ZS0ZHI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rmkef9Zs0Zhi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rmkef9zs0zhi"
        date = "2026-10-16"
    strings:
        $fam_name = "rmkef9zs0zhi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RMKEF9ZS0ZHI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rmkef9Zs0Zhi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rmkef9zs0zhi"
        date = "2026-10-16"
    strings:
        $attrib_str = "rmkef9zs0zhi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rmkefbclnjpi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rmkefbclnjpi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RMKEFBCLNJPI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rmkefbclnjpi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rmkefbclnjpi"
        date = "2026-10-16"
    strings:
        $fam_name = "rmkefbclnjpi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RMKEFBCLNJPI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rmkefbclnjpi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rmkefbclnjpi"
        date = "2026-10-16"
    strings:
        $attrib_str = "rmkefbclnjpi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rmkefdlslaoi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rmkefdlslaoi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RMKEFDLSLAOI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rmkefdlslaoi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rmkefdlslaoi"
        date = "2026-10-16"
    strings:
        $fam_name = "rmkefdlslaoi" ascii wide nocase
        $alias_1 = "trojan.generic.rmkefdlslaoi" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RMKEFDLSLAOI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rmkefdlslaoi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rmkefdlslaoi"
        date = "2026-10-16"
    strings:
        $attrib_str = "rmkefdlslaoi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Roboinstall (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/roboinstall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ROBOINSTALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Roboinstall (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/roboinstall"
        date = "2026-10-16"
    strings:
        $fam_name = "roboinstall" ascii wide nocase
        $alias_1 = "adware.roboinstall" ascii wide nocase
        $alias_2 = "pup.roboinstall" ascii wide nocase
        $alias_3 = "win32/bundler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ROBOINSTALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Roboinstall tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/roboinstall"
        date = "2026-10-16"
    strings:
        $attrib_str = "roboinstall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rockrat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rockrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ROCKRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rockrat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rockrat"
        date = "2026-10-16"
    strings:
        $fam_name = "rockrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ROCKRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rockrat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rockrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "rockrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Rodecap (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rodecap
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RODECAP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rodecap (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rodecap"
        date = "2026-10-16"
    strings:
        $fam_name = "rodecap" ascii wide nocase
        $alias_1 = "trojan:win32/rodecap.a" ascii wide nocase
        $alias_2 = "trojan.win32.rodecap" ascii wide nocase
        $alias_3 = "trojandownloader:win32/rodecap" ascii wide nocase
        $alias_4 = "adware:win64/redcap" ascii wide nocase
        $alias_5 = "trojan.win64.redcap" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RODECAP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rodecap tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rodecap"
        date = "2026-10-16"
    strings:
        $attrib_str = "rodecap" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Rofin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rofin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ROFIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rofin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rofin"
        date = "2026-10-16"
    strings:
        $fam_name = "rofin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ROFIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rofin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rofin"
        date = "2026-10-16"
    strings:
        $attrib_str = "rofin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rogan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rogan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ROGAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rogan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rogan"
        date = "2026-10-16"
    strings:
        $fam_name = "rogan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ROGAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rogan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rogan"
        date = "2026-10-16"
    strings:
        $attrib_str = "rogan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rontokbr (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rontokbr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RONTOKBR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rontokbr (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rontokbr"
        date = "2026-10-16"
    strings:
        $fam_name = "rontokbr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RONTOKBR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rontokbr tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rontokbr"
        date = "2026-10-16"
    strings:
        $attrib_str = "rontokbr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rootkitdrv (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rootkitdrv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ROOTKITDRV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rootkitdrv (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rootkitdrv"
        date = "2026-10-16"
    strings:
        $fam_name = "rootkitdrv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ROOTKITDRV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rootkitdrv tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rootkitdrv"
        date = "2026-10-16"
    strings:
        $attrib_str = "rootkitdrv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rostpay (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rostpay
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ROSTPAY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rostpay (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rostpay"
        date = "2026-10-16"
    strings:
        $fam_name = "rostpay" ascii wide nocase
        $alias_1 = "trojan.rostpay" ascii wide nocase
        $alias_2 = "ransom.locker.rostpay" ascii wide nocase
        $alias_3 = "win32/rostpay" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ROSTPAY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rostpay tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rostpay"
        date = "2026-10-16"
    strings:
        $attrib_str = "rostpay" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rovnix (Bootkit)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rovnix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ROVNIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rovnix (Bootkit)"
        category = "Bootkit"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rovnix"
        date = "2026-10-16"
    strings:
        $fam_name = "rovnix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ROVNIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rovnix tradecraft"
        category = "Bootkit"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rovnix"
        date = "2026-10-16"
    strings:
        $attrib_str = "rovnix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rozena (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rozena
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ROZENA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rozena (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rozena"
        date = "2026-10-16"
    strings:
        $fam_name = "rozena" ascii wide nocase
        $alias_1 = "backdoor:win32/rozena" ascii wide nocase
        $alias_2 = "trojan.win32.rozena" ascii wide nocase
        $alias_3 = "backdoor.rozena" ascii wide nocase
        $alias_4 = "trojan:win32/rozena" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ROZENA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rozena tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rozena"
        date = "2026-10-16"
    strings:
        $attrib_str = "rozena" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Rozenaa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rozenaa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ROZENAA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rozenaa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rozenaa"
        date = "2026-10-16"
    strings:
        $fam_name = "rozenaa" ascii wide nocase
        $alias_1 = "trojan.rozenaa" ascii wide nocase
        $alias_2 = "downloader.rozenaa" ascii wide nocase
        $alias_3 = "win32/rozenaa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ROZENAA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rozenaa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rozenaa"
        date = "2026-10-16"
    strings:
        $attrib_str = "rozenaa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rpcdcom (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rpcdcom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RPCDCOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rpcdcom (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rpcdcom"
        date = "2026-10-16"
    strings:
        $fam_name = "rpcdcom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RPCDCOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rpcdcom tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rpcdcom"
        date = "2026-10-16"
    strings:
        $attrib_str = "rpcdcom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rpdpatch (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rpdpatch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RPDPATCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rpdpatch (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rpdpatch"
        date = "2026-10-16"
    strings:
        $fam_name = "rpdpatch" ascii wide nocase
        $alias_1 = "hacktool.rpdpatch" ascii wide nocase
        $alias_2 = "riskware.rdppatcher" ascii wide nocase
        $alias_3 = "tool.rdpwrap" ascii wide nocase
        $alias_4 = "win32/patch.rdp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RPDPATCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rpdpatch tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rpdpatch"
        date = "2026-10-16"
    strings:
        $attrib_str = "rpdpatch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Ruandmel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ruandmel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUANDMEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ruandmel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruandmel"
        date = "2026-10-16"
    strings:
        $fam_name = "ruandmel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUANDMEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ruandmel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruandmel"
        date = "2026-10-16"
    strings:
        $attrib_str = "ruandmel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ruanmei (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ruanmei
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUANMEI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ruanmei (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruanmei"
        date = "2026-10-16"
    strings:
        $fam_name = "ruanmei" ascii wide nocase
        $alias_1 = "adware.ruanmei" ascii wide nocase
        $alias_2 = "pup.ruanmei" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUANMEI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ruanmei tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruanmei"
        date = "2026-10-16"
    strings:
        $attrib_str = "ruanmei" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rubar (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rubar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rubar (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rubar"
        date = "2026-10-16"
    strings:
        $fam_name = "rubar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rubar tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rubar"
        date = "2026-10-16"
    strings:
        $attrib_str = "rubar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rubat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rubat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUBAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rubat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rubat"
        date = "2026-10-16"
    strings:
        $fam_name = "rubat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUBAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rubat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rubat"
        date = "2026-10-16"
    strings:
        $attrib_str = "rubat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rubinurd (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rubinurd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUBINURD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rubinurd (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rubinurd"
        date = "2026-10-16"
    strings:
        $fam_name = "rubinurd" ascii wide nocase
        $alias_1 = "trojan:win32/rubinurd" ascii wide nocase
        $alias_2 = "trojandownloader:win32/rubinurd" ascii wide nocase
        $alias_3 = "win32/rubinurd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUBINURD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rubinurd tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rubinurd"
        date = "2026-10-16"
    strings:
        $attrib_str = "rubinurd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ruby (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ruby
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUBY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ruby (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruby"
        date = "2026-10-16"
    strings:
        $fam_name = "ruby" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUBY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ruby tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruby"
        date = "2026-10-16"
    strings:
        $attrib_str = "ruby" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ruco (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ruco
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUCO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ruco (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruco"
        date = "2026-10-16"
    strings:
        $fam_name = "ruco" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUCO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ruco tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruco"
        date = "2026-10-16"
    strings:
        $attrib_str = "ruco" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ructo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ructo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUCTO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ructo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ructo"
        date = "2026-10-16"
    strings:
        $fam_name = "ructo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUCTO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ructo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ructo"
        date = "2026-10-16"
    strings:
        $attrib_str = "ructo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ruho (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ruho
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUHO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ruho (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruho"
        date = "2026-10-16"
    strings:
        $fam_name = "ruho" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUHO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ruho tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruho"
        date = "2026-10-16"
    strings:
        $attrib_str = "ruho" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rukoma (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rukoma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUKOMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rukoma (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rukoma"
        date = "2026-10-16"
    strings:
        $fam_name = "rukoma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUKOMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rukoma tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rukoma"
        date = "2026-10-16"
    strings:
        $attrib_str = "rukoma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rukometa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rukometa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUKOMETA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rukometa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rukometa"
        date = "2026-10-16"
    strings:
        $fam_name = "rukometa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUKOMETA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rukometa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rukometa"
        date = "2026-10-16"
    strings:
        $attrib_str = "rukometa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Runbooster (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/runbooster
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUNBOOSTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Runbooster (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/runbooster"
        date = "2026-10-16"
    strings:
        $fam_name = "runbooster" ascii wide nocase
        $alias_1 = "pua:win32/runbooster" ascii wide nocase
        $alias_2 = "rogue:win32/runbooster" ascii wide nocase
        $alias_3 = "adware:win32/runbooster" ascii wide nocase
        $alias_4 = "pup.optional.runbooster" ascii wide nocase
        $alias_5 = "program:win32/runbooster" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUNBOOSTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Runbooster tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/runbooster"
        date = "2026-10-16"
    strings:
        $attrib_str = "runbooster" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rungbu (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rungbu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUNGBU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rungbu (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rungbu"
        date = "2026-10-16"
    strings:
        $fam_name = "rungbu" ascii wide nocase
        $alias_1 = "adware:win32/rungbu" ascii wide nocase
        $alias_2 = "pua:win32/rungbu" ascii wide nocase
        $alias_3 = "adware.rungbu" ascii wide nocase
        $alias_4 = "win32/rungbu" ascii wide nocase
        $alias_5 = "adware:win32/rungbu.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUNGBU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rungbu tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rungbu"
        date = "2026-10-16"
    strings:
        $attrib_str = "rungbu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Runner (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/runner
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUNNER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Runner (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/runner"
        date = "2026-10-16"
    strings:
        $fam_name = "runner" ascii wide nocase
        $alias_1 = "trojan:win32/runner" ascii wide nocase
        $alias_2 = "trojandownloader:win32/runner" ascii wide nocase
        $alias_3 = "win32/runner" ascii wide nocase
        $alias_4 = "runner loader" ascii wide nocase
        $alias_5 = "runner stager" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUNNER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Runner tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/runner"
        date = "2026-10-16"
    strings:
        $attrib_str = "runner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Rupttass (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rupttass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUPTTASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rupttass (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rupttass"
        date = "2026-10-16"
    strings:
        $fam_name = "rupttass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUPTTASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rupttass tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rupttass"
        date = "2026-10-16"
    strings:
        $attrib_str = "rupttass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ruskill (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ruskill
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUSKILL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ruskill (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruskill"
        date = "2026-10-16"
    strings:
        $fam_name = "ruskill" ascii wide nocase
        $alias_1 = "ransom:win32/ruskill" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.ruskill" ascii wide nocase
        $alias_3 = "trojan.ruskill" ascii wide nocase
        $alias_4 = "win32/ruskill" ascii wide nocase
        $alias_5 = "ruskill winlocker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUSKILL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ruskill tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ruskill"
        date = "2026-10-16"
    strings:
        $attrib_str = "ruskill" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Russoturisto (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/russoturisto
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUSSOTURISTO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Russoturisto (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/russoturisto"
        date = "2026-10-16"
    strings:
        $fam_name = "russoturisto" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUSSOTURISTO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Russoturisto tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/russoturisto"
        date = "2026-10-16"
    strings:
        $attrib_str = "russoturisto" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rustock (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rustock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RUSTOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rustock (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rustock"
        date = "2026-10-16"
    strings:
        $fam_name = "rustock" ascii wide nocase
        $alias_1 = "rustock" ascii wide nocase
        $alias_2 = "costrat" ascii wide nocase
        $alias_3 = "rootkit.win32.rustock" ascii wide nocase
        $alias_4 = "spam-mailbot.rustock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RUSTOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rustock tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rustock"
        date = "2026-10-16"
    strings:
        $attrib_str = "rustock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Rvrat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rvrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RVRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rvrat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rvrat"
        date = "2026-10-16"
    strings:
        $fam_name = "rvrat" ascii wide nocase
        $alias_1 = "trojan.rvrat" ascii wide nocase
        $alias_2 = "android.rvrat" ascii wide nocase
        $alias_3 = "backdoor.rvrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RVRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rvrat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rvrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "rvrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ryuk (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ryuk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RYUK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ryuk (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ryuk"
        date = "2026-10-16"
    strings:
        $fam_name = "ryuk" ascii wide nocase
        $alias_1 = "ryuk ransomware" ascii wide nocase
        $alias_2 = "trojan.ransom.ryuk" ascii wide nocase
        $alias_3 = "win32/ryuk" ascii wide nocase
        $alias_4 = "ransom.ryuk" ascii wide nocase
        $alias_5 = "hermes-ryuk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RYUK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ryuk tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ryuk"
        date = "2026-10-16"
    strings:
        $attrib_str = "ryuk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ryzerlo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ryzerlo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RYZERLO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ryzerlo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ryzerlo"
        date = "2026-10-16"
    strings:
        $fam_name = "ryzerlo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RYZERLO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ryzerlo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ryzerlo"
        date = "2026-10-16"
    strings:
        $attrib_str = "ryzerlo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rz0A4Oaeuqdi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rz0a4oaeuqdi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RZ0A4OAEUQDI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rz0A4Oaeuqdi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rz0a4oaeuqdi"
        date = "2026-10-16"
    strings:
        $fam_name = "rz0a4oaeuqdi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RZ0A4OAEUQDI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rz0A4Oaeuqdi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rz0a4oaeuqdi"
        date = "2026-10-16"
    strings:
        $attrib_str = "rz0a4oaeuqdi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Rz0Auircb0Di (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rz0auircb0di
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RZ0AUIRCB0DI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rz0Auircb0Di (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rz0auircb0di"
        date = "2026-10-16"
    strings:
        $fam_name = "rz0auircb0di" ascii wide nocase
        $alias_1 = "trojan.generic.rz0auircb0di" ascii wide nocase
        $alias_2 = "malware.obfuscated.dga" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RZ0AUIRCB0DI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rz0Auircb0Di tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rz0auircb0di"
        date = "2026-10-16"
    strings:
        $attrib_str = "rz0auircb0di" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Rzwaagpbkfii (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/rzwaagpbkfii
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RZWAAGPBKFII_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rzwaagpbkfii (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rzwaagpbkfii"
        date = "2026-10-16"
    strings:
        $fam_name = "rzwaagpbkfii" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RZWAAGPBKFII_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rzwaagpbkfii tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/rzwaagpbkfii"
        date = "2026-10-16"
    strings:
        $attrib_str = "rzwaagpbkfii" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sadenav (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sadenav
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SADENAV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sadenav (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sadenav"
        date = "2026-10-16"
    strings:
        $fam_name = "sadenav" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SADENAV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sadenav tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sadenav"
        date = "2026-10-16"
    strings:
        $attrib_str = "sadenav" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sadredi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sadredi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SADREDI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sadredi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sadredi"
        date = "2026-10-16"
    strings:
        $fam_name = "sadredi" ascii wide nocase
        $alias_1 = "trojan.sadredi" ascii wide nocase
        $alias_2 = "downloader.sadredi" ascii wide nocase
        $alias_3 = "win32/sadredi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SADREDI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sadredi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sadredi"
        date = "2026-10-16"
    strings:
        $attrib_str = "sadredi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Saencrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/saencrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAENCRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Saencrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/saencrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "saencrypt" ascii wide nocase
        $alias_1 = "ransomware.saencrypt" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.saencrypt" ascii wide nocase
        $alias_3 = "cryptolocker.sa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAENCRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Saencrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/saencrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "saencrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Safebreas (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/safebreas
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAFEBREAS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Safebreas (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/safebreas"
        date = "2026-10-16"
    strings:
        $fam_name = "safebreas" ascii wide nocase
        $alias_1 = "trojan.safebreas" ascii wide nocase
        $alias_2 = "downloader.safebreas" ascii wide nocase
        $alias_3 = "win32/safebreas" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAFEBREAS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Safebreas tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/safebreas"
        date = "2026-10-16"
    strings:
        $attrib_str = "safebreas" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Safebytes (Rogueware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/safebytes
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAFEBYTES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Safebytes (Rogueware)"
        category = "Rogueware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/safebytes"
        date = "2026-10-16"
    strings:
        $fam_name = "safebytes" ascii wide nocase
        $alias_1 = "rogue:win32/safebytes" ascii wide nocase
        $alias_2 = "program:win32/safebytes" ascii wide nocase
        $alias_3 = "pup.optional.safebytes" ascii wide nocase
        $alias_4 = "troj/safebyte-a" ascii wide nocase
        $alias_5 = "safebytes total system care" ascii wide nocase
        $alias_6 = "driverassist" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAFEBYTES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Safebytes tradecraft"
        category = "Rogueware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/safebytes"
        date = "2026-10-16"
    strings:
        $attrib_str = "safebytes" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Safeterra (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/safeterra
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAFETERRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Safeterra (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/safeterra"
        date = "2026-10-16"
    strings:
        $fam_name = "safeterra" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAFETERRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Safeterra tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/safeterra"
        date = "2026-10-16"
    strings:
        $attrib_str = "safeterra" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sage (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sage
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sage (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sage"
        date = "2026-10-16"
    strings:
        $fam_name = "sage" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sage tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sage"
        date = "2026-10-16"
    strings:
        $attrib_str = "sage" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sagecrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sagecrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAGECRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sagecrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sagecrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "sagecrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAGECRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sagecrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sagecrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "sagecrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sagonaire (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sagonaire
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAGONAIRE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sagonaire (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sagonaire"
        date = "2026-10-16"
    strings:
        $fam_name = "sagonaire" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAGONAIRE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sagonaire tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sagonaire"
        date = "2026-10-16"
    strings:
        $attrib_str = "sagonaire" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sahat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sahat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAHAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sahat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sahat"
        date = "2026-10-16"
    strings:
        $fam_name = "sahat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAHAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sahat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sahat"
        date = "2026-10-16"
    strings:
        $attrib_str = "sahat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sakto (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sakto
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAKTO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sakto (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sakto"
        date = "2026-10-16"
    strings:
        $fam_name = "sakto" ascii wide nocase
        $alias_1 = "trojan.sakto" ascii wide nocase
        $alias_2 = "downloader.sakto" ascii wide nocase
        $alias_3 = "win32/sakto" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAKTO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sakto tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sakto"
        date = "2026-10-16"
    strings:
        $attrib_str = "sakto" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Salgorea (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/salgorea
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SALGOREA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Salgorea (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/salgorea"
        date = "2026-10-16"
    strings:
        $fam_name = "salgorea" ascii wide nocase
        $alias_1 = "backdoor.win32.salgorea" ascii wide nocase
        $alias_2 = "badcake" ascii wide nocase
        $alias_3 = "trojan:win32/salgorea" ascii wide nocase
        $alias_4 = "apt32 salgorea backdoor" ascii wide nocase
        $alias_5 = "oceanlotus salgorea" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SALGOREA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Salgorea tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/salgorea"
        date = "2026-10-16"
    strings:
        $attrib_str = "salgorea" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Sality (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sality
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SALITY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sality (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sality"
        date = "2026-10-16"
    strings:
        $fam_name = "sality" ascii wide nocase
        $alias_1 = "sality" ascii wide nocase
        $alias_2 = "win32.sality" ascii wide nocase
        $alias_3 = "sality.ae" ascii wide nocase
        $alias_4 = "sality.gen" ascii wide nocase
        $alias_5 = "kuku" ascii wide nocase
        $alias_6 = "sality_p2p" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SALITY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sality tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sality"
        date = "2026-10-16"
    strings:
        $attrib_str = "sality" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Samas (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/samas
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAMAS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Samas (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/samas"
        date = "2026-10-16"
    strings:
        $fam_name = "samas" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAMAS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Samas tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/samas"
        date = "2026-10-16"
    strings:
        $attrib_str = "samas" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Samca (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/samca
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAMCA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Samca (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/samca"
        date = "2026-10-16"
    strings:
        $fam_name = "samca" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAMCA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Samca tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/samca"
        date = "2026-10-16"
    strings:
        $attrib_str = "samca" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Samsam (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/samsam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SAMSAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Samsam (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/samsam"
        date = "2026-10-16"
    strings:
        $fam_name = "samsam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SAMSAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Samsam tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/samsam"
        date = "2026-10-16"
    strings:
        $attrib_str = "samsam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sanctionedmedia (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sanctionedmedia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SANCTIONEDMEDIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sanctionedmedia (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sanctionedmedia"
        date = "2026-10-16"
    strings:
        $fam_name = "sanctionedmedia" ascii wide nocase
        $alias_1 = "adware.sanctionedmedia" ascii wide nocase
        $alias_2 = "pup.sanctionedmedia" ascii wide nocase
        $alias_3 = "win32/adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SANCTIONEDMEDIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sanctionedmedia tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sanctionedmedia"
        date = "2026-10-16"
    strings:
        $attrib_str = "sanctionedmedia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sankei (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sankei
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SANKEI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sankei (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sankei"
        date = "2026-10-16"
    strings:
        $fam_name = "sankei" ascii wide nocase
        $alias_1 = "trojan.sankei" ascii wide nocase
        $alias_2 = "downloader.sankei" ascii wide nocase
        $alias_3 = "win32/sankei" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SANKEI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sankei tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sankei"
        date = "2026-10-16"
    strings:
        $attrib_str = "sankei" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sasfis (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sasfis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SASFIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sasfis (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sasfis"
        date = "2026-10-16"
    strings:
        $fam_name = "sasfis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SASFIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sasfis tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sasfis"
        date = "2026-10-16"
    strings:
        $attrib_str = "sasfis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sasquor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sasquor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SASQUOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sasquor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sasquor"
        date = "2026-10-16"
    strings:
        $fam_name = "sasquor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SASQUOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sasquor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sasquor"
        date = "2026-10-16"
    strings:
        $attrib_str = "sasquor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Satan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/satan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SATAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Satan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/satan"
        date = "2026-10-16"
    strings:
        $fam_name = "satan" ascii wide nocase
        $alias_1 = "ransom:win32/satan" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.satan" ascii wide nocase
        $alias_3 = "lucky ransomware" ascii wide nocase
        $alias_4 = "satan raas" ascii wide nocase
        $alias_5 = "win32/satan" ascii wide nocase
        $alias_6 = "ransom:linux/satan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SATAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Satan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/satan"
        date = "2026-10-16"
    strings:
        $attrib_str = "satan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Satana (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/satana
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SATANA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Satana (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/satana"
        date = "2026-10-16"
    strings:
        $fam_name = "satana" ascii wide nocase
        $alias_1 = "ransomware.satana" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.satana" ascii wide nocase
        $alias_3 = "bootlocker.satana" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SATANA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Satana tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/satana"
        date = "2026-10-16"
    strings:
        $attrib_str = "satana" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Satancrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/satancrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SATANCRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Satancrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/satancrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "satancrypt" ascii wide nocase
        $alias_1 = "ransomware.satan" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.satancrypt" ascii wide nocase
        $alias_3 = "win32/satana" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SATANCRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Satancrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/satancrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "satancrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sathurbot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sathurbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SATHURBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sathurbot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sathurbot"
        date = "2026-10-16"
    strings:
        $fam_name = "sathurbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SATHURBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sathurbot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sathurbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "sathurbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Saturn (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/saturn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SATURN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Saturn (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/saturn"
        date = "2026-10-16"
    strings:
        $fam_name = "saturn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SATURN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Saturn tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/saturn"
        date = "2026-10-16"
    strings:
        $attrib_str = "saturn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Satwancrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/satwancrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SATWANCRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Satwancrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/satwancrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "satwancrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SATWANCRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Satwancrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/satwancrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "satwancrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sbdbat2Exe (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sbdbat2exe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SBDBAT2EXE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sbdbat2Exe (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sbdbat2exe"
        date = "2026-10-16"
    strings:
        $fam_name = "sbdbat2exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SBDBAT2EXE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sbdbat2Exe tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sbdbat2exe"
        date = "2026-10-16"
    strings:
        $attrib_str = "sbdbat2exe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sbdld (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sbdld
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SBDLD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sbdld (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sbdld"
        date = "2026-10-16"
    strings:
        $fam_name = "sbdld" ascii wide nocase
        $alias_1 = "trojan.downloader.sbdld" ascii wide nocase
        $alias_2 = "trojan.sbdld" ascii wide nocase
        $alias_3 = "win32/sbdld" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SBDLD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sbdld tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sbdld"
        date = "2026-10-16"
    strings:
        $attrib_str = "sbdld" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sbyinying (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sbyinying
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SBYINYING_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sbyinying (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sbyinying"
        date = "2026-10-16"
    strings:
        $fam_name = "sbyinying" ascii wide nocase
        $alias_1 = "adware.sbyinying" ascii wide nocase
        $alias_2 = "pup.sbyinying" ascii wide nocase
        $alias_3 = "win32/sbyinying" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SBYINYING_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sbyinying tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sbyinying"
        date = "2026-10-16"
    strings:
        $attrib_str = "sbyinying" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Scano (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scano
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCANO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scano (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scano"
        date = "2026-10-16"
    strings:
        $fam_name = "scano" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCANO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scano tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scano"
        date = "2026-10-16"
    strings:
        $attrib_str = "scano" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Scar (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scar (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scar"
        date = "2026-10-16"
    strings:
        $fam_name = "scar" ascii wide nocase
        $alias_1 = "scar" ascii wide nocase
        $alias_2 = "trojan:win32/scar" ascii wide nocase
        $alias_3 = "trojan.win32.scar" ascii wide nocase
        $alias_4 = "win32/scar" ascii wide nocase
        $alias_5 = "downloader.scar" ascii wide nocase
        $alias_6 = "scar trojan" ascii wide nocase
        $alias_7 = "trojan:win32/scar.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scar tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scar"
        date = "2026-10-16"
    strings:
        $attrib_str = "scar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Scarab (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scarab
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCARAB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scarab (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scarab"
        date = "2026-10-16"
    strings:
        $fam_name = "scarab" ascii wide nocase
        $alias_1 = "ransom:win32/scarab" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.scarab" ascii wide nocase
        $alias_3 = "ransom.scarab" ascii wide nocase
        $alias_4 = "scarab ransomware" ascii wide nocase
        $alias_5 = "win32/scarab" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCARAB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scarab tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scarab"
        date = "2026-10-16"
    strings:
        $attrib_str = "scarab" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Scarcruft (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scarcruft
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCARCRUFT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scarcruft (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scarcruft"
        date = "2026-10-16"
    strings:
        $fam_name = "scarcruft" ascii wide nocase
        $alias_1 = "apt37" ascii wide nocase
        $alias_2 = "reaper" ascii wide nocase
        $alias_3 = "group123" ascii wide nocase
        $alias_4 = "rokrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCARCRUFT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scarcruft tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scarcruft"
        date = "2026-10-16"
    strings:
        $attrib_str = "scarcruft" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Scarsi (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scarsi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCARSI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scarsi (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scarsi"
        date = "2026-10-16"
    strings:
        $fam_name = "scarsi" ascii wide nocase
        $alias_1 = "backdoor:win32/scarsi" ascii wide nocase
        $alias_2 = "trojan:win32/scarsi" ascii wide nocase
        $alias_3 = "win32/scarsi" ascii wide nocase
        $alias_4 = "trojan.scarsi" ascii wide nocase
        $alias_5 = "backdoor.scarsi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCARSI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scarsi tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scarsi"
        date = "2026-10-16"
    strings:
        $attrib_str = "scarsi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Schoolboy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/schoolboy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCHOOLBOY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Schoolboy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/schoolboy"
        date = "2026-10-16"
    strings:
        $fam_name = "schoolboy" ascii wide nocase
        $alias_1 = "ransom:win32/schoolboy" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.schoolboy" ascii wide nocase
        $alias_3 = "win32/schoolboy" ascii wide nocase
        $alias_4 = "ransom.schoolboy" ascii wide nocase
        $alias_5 = "ransom:win32/schoolboy.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCHOOLBOY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Schoolboy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/schoolboy"
        date = "2026-10-16"
    strings:
        $attrib_str = "schoolboy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Schoolbus (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/schoolbus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCHOOLBUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Schoolbus (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/schoolbus"
        date = "2026-10-16"
    strings:
        $fam_name = "schoolbus" ascii wide nocase
        $alias_1 = "backdoor:win32/schoolbus" ascii wide nocase
        $alias_2 = "trojan.win32.schoolbus" ascii wide nocase
        $alias_3 = "backdoor.schoolbus" ascii wide nocase
        $alias_4 = "win32/schoolbus.rat" ascii wide nocase
        $alias_5 = "schoolbus.server" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCHOOLBUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Schoolbus tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/schoolbus"
        date = "2026-10-16"
    strings:
        $attrib_str = "schoolbus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Schoolgirl (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/schoolgirl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCHOOLGIRL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Schoolgirl (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/schoolgirl"
        date = "2026-10-16"
    strings:
        $fam_name = "schoolgirl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCHOOLGIRL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Schoolgirl tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/schoolgirl"
        date = "2026-10-16"
    strings:
        $attrib_str = "schoolgirl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Schwarzesonne (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/schwarzesonne
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCHWARZESONNE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Schwarzesonne (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/schwarzesonne"
        date = "2026-10-16"
    strings:
        $fam_name = "schwarzesonne" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCHWARZESONNE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Schwarzesonne tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/schwarzesonne"
        date = "2026-10-16"
    strings:
        $attrib_str = "schwarzesonne" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sciagnij (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sciagnij
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCIAGNIJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sciagnij (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sciagnij"
        date = "2026-10-16"
    strings:
        $fam_name = "sciagnij" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCIAGNIJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sciagnij tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sciagnij"
        date = "2026-10-16"
    strings:
        $attrib_str = "sciagnij" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Scomma (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scomma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCOMMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scomma (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scomma"
        date = "2026-10-16"
    strings:
        $fam_name = "scomma" ascii wide nocase
        $alias_1 = "trojan.scomma" ascii wide nocase
        $alias_2 = "downloader.scomma" ascii wide nocase
        $alias_3 = "win32/scomma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCOMMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scomma tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scomma"
        date = "2026-10-16"
    strings:
        $attrib_str = "scomma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Scoopy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scoopy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCOOPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scoopy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scoopy"
        date = "2026-10-16"
    strings:
        $fam_name = "scoopy" ascii wide nocase
        $alias_1 = "trojan.scoopy" ascii wide nocase
        $alias_2 = "downloader.scoopy" ascii wide nocase
        $alias_3 = "win32/scoopy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCOOPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scoopy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scoopy"
        date = "2026-10-16"
    strings:
        $attrib_str = "scoopy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Scrami (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scrami
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCRAMI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scrami (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scrami"
        date = "2026-10-16"
    strings:
        $fam_name = "scrami" ascii wide nocase
        $alias_1 = "trojan.scrami" ascii wide nocase
        $alias_2 = "downloader.scrami" ascii wide nocase
        $alias_3 = "win32/scrami" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCRAMI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scrami tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scrami"
        date = "2026-10-16"
    strings:
        $attrib_str = "scrami" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Scramupx (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scramupx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCRAMUPX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scramupx (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scramupx"
        date = "2026-10-16"
    strings:
        $fam_name = "scramupx" ascii wide nocase
        $alias_1 = "packer.scramupx" ascii wide nocase
        $alias_2 = "tool.upxscrambler" ascii wide nocase
        $alias_3 = "obfuscator.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCRAMUPX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scramupx tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scramupx"
        date = "2026-10-16"
    strings:
        $attrib_str = "scramupx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Screen (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/screen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCREEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Screen (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/screen"
        date = "2026-10-16"
    strings:
        $fam_name = "screen" ascii wide nocase
        $alias_1 = "trojan-ransom.win32.screen" ascii wide nocase
        $alias_2 = "screenlocker" ascii wide nocase
        $alias_3 = "winlock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCREEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Screen tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/screen"
        date = "2026-10-16"
    strings:
        $attrib_str = "screen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Screenconnect (Hacktool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/screenconnect
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCREENCONNECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Screenconnect (Hacktool)"
        category = "Hacktool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/screenconnect"
        date = "2026-10-16"
    strings:
        $fam_name = "screenconnect" ascii wide nocase
        $alias_1 = "tool:win32/screenconnect" ascii wide nocase
        $alias_2 = "remoteaccess:win32/screenconnect" ascii wide nocase
        $alias_3 = "screenconnect remote access" ascii wide nocase
        $alias_4 = "connectwise screenconnect abuse" ascii wide nocase
        $alias_5 = "hacktool:win32/screenconnect" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCREENCONNECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Screenconnect tradecraft"
        category = "Hacktool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/screenconnect"
        date = "2026-10-16"
    strings:
        $attrib_str = "screenconnect" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Screenmate (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/screenmate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCREENMATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Screenmate (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/screenmate"
        date = "2026-10-16"
    strings:
        $fam_name = "screenmate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCREENMATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Screenmate tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/screenmate"
        date = "2026-10-16"
    strings:
        $attrib_str = "screenmate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Scribble (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scribble
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCRIBBLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scribble (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scribble"
        date = "2026-10-16"
    strings:
        $fam_name = "scribble" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCRIBBLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scribble tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scribble"
        date = "2026-10-16"
    strings:
        $attrib_str = "scribble" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Scriptkd (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scriptkd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCRIPTKD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scriptkd (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scriptkd"
        date = "2026-10-16"
    strings:
        $fam_name = "scriptkd" ascii wide nocase
        $alias_1 = "ransom:win32/scriptkd" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.scriptkd" ascii wide nocase
        $alias_3 = "win32/scriptkd" ascii wide nocase
        $alias_4 = "scriptkd ransomware" ascii wide nocase
        $alias_5 = "ransom.scriptkd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCRIPTKD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scriptkd tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scriptkd"
        date = "2026-10-16"
    strings:
        $attrib_str = "scriptkd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Scrop (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/scrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SCROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scrop (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scrop"
        date = "2026-10-16"
    strings:
        $fam_name = "scrop" ascii wide nocase
        $alias_1 = "trojan-dropper:win32/scrop" ascii wide nocase
        $alias_2 = "backdoor:win32/scrop" ascii wide nocase
        $alias_3 = "trojan.win32.scrop" ascii wide nocase
        $alias_4 = "win32/scrop" ascii wide nocase
        $alias_5 = "dropper.win32.scrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SCROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scrop tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/scrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "scrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sdbot (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sdbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SDBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sdbot (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sdbot"
        date = "2026-10-16"
    strings:
        $fam_name = "sdbot" ascii wide nocase
        $alias_1 = "sdbot" ascii wide nocase
        $alias_2 = "sdbot" ascii wide nocase
        $alias_3 = "win32/sdbot" ascii wide nocase
        $alias_4 = "rbot" ascii wide nocase
        $alias_5 = "spybot" ascii wide nocase
        $alias_6 = "backdoor.sdbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SDBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sdbot tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sdbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "sdbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Sdld (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sdld
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SDLD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sdld (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sdld"
        date = "2026-10-16"
    strings:
        $fam_name = "sdld" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SDLD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sdld tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sdld"
        date = "2026-10-16"
    strings:
        $attrib_str = "sdld" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sdrop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sdrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SDROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sdrop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sdrop"
        date = "2026-10-16"
    strings:
        $fam_name = "sdrop" ascii wide nocase
        $alias_1 = "trojan.sdrop" ascii wide nocase
        $alias_2 = "dropper.sdrop" ascii wide nocase
        $alias_3 = "win32/sdrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SDROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sdrop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sdrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "sdrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Searchbar (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/searchbar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEARCHBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Searchbar (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/searchbar"
        date = "2026-10-16"
    strings:
        $fam_name = "searchbar" ascii wide nocase
        $alias_1 = "adware.searchbar" ascii wide nocase
        $alias_2 = "pup.searchbar" ascii wide nocase
        $alias_3 = "browsermodifier:win32/searchbar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEARCHBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Searchbar tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/searchbar"
        date = "2026-10-16"
    strings:
        $attrib_str = "searchbar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Searchgo (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/searchgo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEARCHGO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Searchgo (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/searchgo"
        date = "2026-10-16"
    strings:
        $fam_name = "searchgo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEARCHGO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Searchgo tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/searchgo"
        date = "2026-10-16"
    strings:
        $attrib_str = "searchgo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Searchpage (Browser_Modifier)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/searchpage
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEARCHPAGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Searchpage (Browser_Modifier)"
        category = "Browser_Modifier"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/searchpage"
        date = "2026-10-16"
    strings:
        $fam_name = "searchpage" ascii wide nocase
        $alias_1 = "browsermodifier:win32/searchpage" ascii wide nocase
        $alias_2 = "adware:win32/searchpage" ascii wide nocase
        $alias_3 = "win32/searchpage" ascii wide nocase
        $alias_4 = "searchpage hijacker" ascii wide nocase
        $alias_5 = "trojan.searchpage" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEARCHPAGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Searchpage tradecraft"
        category = "Browser_Modifier"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/searchpage"
        date = "2026-10-16"
    strings:
        $attrib_str = "searchpage" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Searchprovide (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/searchprovide
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEARCHPROVIDE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Searchprovide (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/searchprovide"
        date = "2026-10-16"
    strings:
        $fam_name = "searchprovide" ascii wide nocase
        $alias_1 = "adware.searchprovide" ascii wide nocase
        $alias_2 = "browserhijacker.searchprovide" ascii wide nocase
        $alias_3 = "pup.searchprovider" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEARCHPROVIDE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Searchprovide tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/searchprovide"
        date = "2026-10-16"
    strings:
        $attrib_str = "searchprovide" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Searchsetter (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/searchsetter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEARCHSETTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Searchsetter (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/searchsetter"
        date = "2026-10-16"
    strings:
        $fam_name = "searchsetter" ascii wide nocase
        $alias_1 = "adware.searchsetter" ascii wide nocase
        $alias_2 = "pup.searchsetter" ascii wide nocase
        $alias_3 = "browsermodifier:win32/searchsetter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEARCHSETTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Searchsetter tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/searchsetter"
        date = "2026-10-16"
    strings:
        $attrib_str = "searchsetter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Secucharge (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/secucharge
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SECUCHARGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Secucharge (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/secucharge"
        date = "2026-10-16"
    strings:
        $fam_name = "secucharge" ascii wide nocase
        $alias_1 = "adware.secucharge" ascii wide nocase
        $alias_2 = "pup.secucharge" ascii wide nocase
        $alias_3 = "win32/adware.secucharge" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SECUCHARGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Secucharge tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/secucharge"
        date = "2026-10-16"
    strings:
        $attrib_str = "secucharge" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Security (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/security
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SECURITY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Security (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/security"
        date = "2026-10-16"
    strings:
        $fam_name = "security" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SECURITY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Security tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/security"
        date = "2026-10-16"
    strings:
        $attrib_str = "security" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Securityshield (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/securityshield
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SECURITYSHIELD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Securityshield (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/securityshield"
        date = "2026-10-16"
    strings:
        $fam_name = "securityshield" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SECURITYSHIELD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Securityshield tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/securityshield"
        date = "2026-10-16"
    strings:
        $attrib_str = "securityshield" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Securityxploded (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/securityxploded
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SECURITYXPLODED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Securityxploded (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/securityxploded"
        date = "2026-10-16"
    strings:
        $fam_name = "securityxploded" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SECURITYXPLODED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Securityxploded tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/securityxploded"
        date = "2026-10-16"
    strings:
        $attrib_str = "securityxploded" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Seeav (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/seeav
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEEAV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Seeav (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/seeav"
        date = "2026-10-16"
    strings:
        $fam_name = "seeav" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEEAV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Seeav tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/seeav"
        date = "2026-10-16"
    strings:
        $attrib_str = "seeav" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Seed (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/seed
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Seed (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/seed"
        date = "2026-10-16"
    strings:
        $fam_name = "seed" ascii wide nocase
        $alias_1 = "backdoor:win32/seed" ascii wide nocase
        $alias_2 = "trojan.win32.seed" ascii wide nocase
        $alias_3 = "backdoor.seed" ascii wide nocase
        $alias_4 = "win32/seed.rat" ascii wide nocase
        $alias_5 = "seed.server" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Seed tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/seed"
        date = "2026-10-16"
    strings:
        $attrib_str = "seed" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sefnit (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sefnit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEFNIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sefnit (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sefnit"
        date = "2026-10-16"
    strings:
        $fam_name = "sefnit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEFNIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sefnit tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sefnit"
        date = "2026-10-16"
    strings:
        $attrib_str = "sefnit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Selcry (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/selcry
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SELCRY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Selcry (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/selcry"
        date = "2026-10-16"
    strings:
        $fam_name = "selcry" ascii wide nocase
        $alias_1 = "trojan.selcry" ascii wide nocase
        $alias_2 = "downloader.selcry" ascii wide nocase
        $alias_3 = "win32/selcry" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SELCRY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Selcry tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/selcry"
        date = "2026-10-16"
    strings:
        $attrib_str = "selcry" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Selltim (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/selltim
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SELLTIM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Selltim (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/selltim"
        date = "2026-10-16"
    strings:
        $fam_name = "selltim" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SELLTIM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Selltim tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/selltim"
        date = "2026-10-16"
    strings:
        $attrib_str = "selltim" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sennaonemaker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sennaonemaker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SENNAONEMAKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sennaonemaker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sennaonemaker"
        date = "2026-10-16"
    strings:
        $fam_name = "sennaonemaker" ascii wide nocase
        $alias_1 = "adware.sennaonemaker" ascii wide nocase
        $alias_2 = "pup.sennaonemaker" ascii wide nocase
        $alias_3 = "win32/sennaonemaker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SENNAONEMAKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sennaonemaker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sennaonemaker"
        date = "2026-10-16"
    strings:
        $attrib_str = "sennaonemaker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sennoma (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sennoma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SENNOMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sennoma (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sennoma"
        date = "2026-10-16"
    strings:
        $fam_name = "sennoma" ascii wide nocase
        $alias_1 = "trojan.sennoma" ascii wide nocase
        $alias_2 = "downloader.sennoma" ascii wide nocase
        $alias_3 = "win32/sennoma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SENNOMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sennoma tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sennoma"
        date = "2026-10-16"
    strings:
        $attrib_str = "sennoma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Senta (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/senta
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SENTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Senta (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/senta"
        date = "2026-10-16"
    strings:
        $fam_name = "senta" ascii wide nocase
        $alias_1 = "trojan.senta" ascii wide nocase
        $alias_2 = "downloader.senta" ascii wide nocase
        $alias_3 = "win32/senta" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SENTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Senta tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/senta"
        date = "2026-10-16"
    strings:
        $attrib_str = "senta" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sentinel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sentinel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SENTINEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sentinel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sentinel"
        date = "2026-10-16"
    strings:
        $fam_name = "sentinel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SENTINEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sentinel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sentinel"
        date = "2026-10-16"
    strings:
        $attrib_str = "sentinel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Seodec (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/seodec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEODEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Seodec (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/seodec"
        date = "2026-10-16"
    strings:
        $fam_name = "seodec" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEODEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Seodec tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/seodec"
        date = "2026-10-16"
    strings:
        $attrib_str = "seodec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Separ (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/separ
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEPAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Separ (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/separ"
        date = "2026-10-16"
    strings:
        $fam_name = "separ" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEPAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Separ tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/separ"
        date = "2026-10-16"
    strings:
        $attrib_str = "separ" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Serenity_Rat (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/serenity_rat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SERENITY_RAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Serenity_Rat (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/serenity_rat"
        date = "2026-10-16"
    strings:
        $fam_name = "serenity_rat" ascii wide nocase
        $alias_1 = "serenity rat" ascii wide nocase
        $alias_2 = "backdoor.win32.serenity" ascii wide nocase
        $alias_3 = "serenity by killua" ascii wide nocase
        $alias_4 = "win32/serenity.rat" ascii wide nocase
        $alias_5 = "trojan.serenity" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SERENITY_RAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Serenity_Rat tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/serenity_rat"
        date = "2026-10-16"
    strings:
        $attrib_str = "serenity_rat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Serveradmin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/serveradmin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SERVERADMIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Serveradmin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/serveradmin"
        date = "2026-10-16"
    strings:
        $fam_name = "serveradmin" ascii wide nocase
        $alias_1 = "riskware.remoteadmin" ascii wide nocase
        $alias_2 = "tool.remoteaccess" ascii wide nocase
        $alias_3 = "win32/remoteadmin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SERVERADMIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Serveradmin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/serveradmin"
        date = "2026-10-16"
    strings:
        $attrib_str = "serveradmin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Seznam (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/seznam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SEZNAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Seznam (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/seznam"
        date = "2026-10-16"
    strings:
        $fam_name = "seznam" ascii wide nocase
        $alias_1 = "adware.seznam" ascii wide nocase
        $alias_2 = "browserhijacker.seznam" ascii wide nocase
        $alias_3 = "pup.seznamtoolbar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SEZNAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Seznam tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/seznam"
        date = "2026-10-16"
    strings:
        $attrib_str = "seznam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sfdld (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sfdld
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SFDLD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sfdld (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sfdld"
        date = "2026-10-16"
    strings:
        $fam_name = "sfdld" ascii wide nocase
        $alias_1 = "downloader.sfdld" ascii wide nocase
        $alias_2 = "trojan.sfdld" ascii wide nocase
        $alias_3 = "win32/trojandownloader.sfdld" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SFDLD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sfdld tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sfdld"
        date = "2026-10-16"
    strings:
        $attrib_str = "sfdld" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sfone (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sfone
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SFONE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sfone (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sfone"
        date = "2026-10-16"
    strings:
        $fam_name = "sfone" ascii wide nocase
        $alias_1 = "worm:win32/sfone" ascii wide nocase
        $alias_2 = "worm.win32.sfone" ascii wide nocase
        $alias_3 = "worm.win32.sfone.b" ascii wide nocase
        $alias_4 = "trojan:win32/sfone!pz" ascii wide nocase
        $alias_5 = "win32/sfone" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SFONE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sfone tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sfone"
        date = "2026-10-16"
    strings:
        $attrib_str = "sfone" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sfuzuan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sfuzuan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SFUZUAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sfuzuan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sfuzuan"
        date = "2026-10-16"
    strings:
        $fam_name = "sfuzuan" ascii wide nocase
        $alias_1 = "trojan.sfuzuan" ascii wide nocase
        $alias_2 = "downloader.sfuzuan" ascii wide nocase
        $alias_3 = "win32/sfuzuan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SFUZUAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sfuzuan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sfuzuan"
        date = "2026-10-16"
    strings:
        $attrib_str = "sfuzuan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shade (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shade
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHADE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shade (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shade"
        date = "2026-10-16"
    strings:
        $fam_name = "shade" ascii wide nocase
        $alias_1 = "ransom:win32/shade" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.shade" ascii wide nocase
        $alias_3 = "troldesh" ascii wide nocase
        $alias_4 = "encoder.858" ascii wide nocase
        $alias_5 = "win32/troldesh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHADE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shade tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shade"
        date = "2026-10-16"
    strings:
        $attrib_str = "shade" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shadowbrokers (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shadowbrokers
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHADOWBROKERS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shadowbrokers (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shadowbrokers"
        date = "2026-10-16"
    strings:
        $fam_name = "shadowbrokers" ascii wide nocase
        $alias_1 = "exploit:win32/shadowbrokers" ascii wide nocase
        $alias_2 = "hacktool:win32/shadowbrokers" ascii wide nocase
        $alias_3 = "the shadow brokers leaks" ascii wide nocase
        $alias_4 = "equation group lost in translation" ascii wide nocase
        $alias_5 = "win32/shadowbrokers" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHADOWBROKERS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shadowbrokers tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shadowbrokers"
        date = "2026-10-16"
    strings:
        $attrib_str = "shadowbrokers" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Shadowhammer (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shadowhammer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHADOWHAMMER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shadowhammer (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shadowhammer"
        date = "2026-10-16"
    strings:
        $fam_name = "shadowhammer" ascii wide nocase
        $alias_1 = "apt.shadowhammer" ascii wide nocase
        $alias_2 = "trojan.asusupdate" ascii wide nocase
        $alias_3 = "backdoor.barium" ascii wide nocase
        $alias_4 = "apt41" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHADOWHAMMER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shadowhammer tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shadowhammer"
        date = "2026-10-16"
    strings:
        $attrib_str = "shadowhammer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Shakblades (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shakblades
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHAKBLADES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shakblades (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shakblades"
        date = "2026-10-16"
    strings:
        $fam_name = "shakblades" ascii wide nocase
        $alias_1 = "ransom:win32/shakblades" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.shakblades" ascii wide nocase
        $alias_3 = "ransom.shakblades" ascii wide nocase
        $alias_4 = "win32/shakblades" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHAKBLADES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shakblades tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shakblades"
        date = "2026-10-16"
    strings:
        $attrib_str = "shakblades" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shandaadd (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shandaadd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHANDAADD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shandaadd (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shandaadd"
        date = "2026-10-16"
    strings:
        $fam_name = "shandaadd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHANDAADD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shandaadd tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shandaadd"
        date = "2026-10-16"
    strings:
        $attrib_str = "shandaadd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Shaosmine (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shaosmine
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHAOSMINE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shaosmine (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shaosmine"
        date = "2026-10-16"
    strings:
        $fam_name = "shaosmine" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHAOSMINE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shaosmine tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shaosmine"
        date = "2026-10-16"
    strings:
        $attrib_str = "shaosmine" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sharer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sharer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHARER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sharer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sharer"
        date = "2026-10-16"
    strings:
        $fam_name = "sharer" ascii wide nocase
        $alias_1 = "worm.p2p.sharer" ascii wide nocase
        $alias_2 = "trojan.p2p" ascii wide nocase
        $alias_3 = "win32/sharer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHARER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sharer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sharer"
        date = "2026-10-16"
    strings:
        $attrib_str = "sharer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Shark (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shark
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHARK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shark (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shark"
        date = "2026-10-16"
    strings:
        $fam_name = "shark" ascii wide nocase
        $alias_1 = "rat.shark" ascii wide nocase
        $alias_2 = "trojan.sharkrat" ascii wide nocase
        $alias_3 = "win32/shark" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHARK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shark tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shark"
        date = "2026-10-16"
    strings:
        $attrib_str = "shark" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shaskooth (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shaskooth
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHASKOOTH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shaskooth (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shaskooth"
        date = "2026-10-16"
    strings:
        $fam_name = "shaskooth" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHASKOOTH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shaskooth tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shaskooth"
        date = "2026-10-16"
    strings:
        $attrib_str = "shaskooth" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sheldor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sheldor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHELDOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sheldor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sheldor"
        date = "2026-10-16"
    strings:
        $fam_name = "sheldor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHELDOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sheldor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sheldor"
        date = "2026-10-16"
    strings:
        $attrib_str = "sheldor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shell (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shell
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHELL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shell (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shell"
        date = "2026-10-16"
    strings:
        $fam_name = "shell" ascii wide nocase
        $alias_1 = "hacktool.shell" ascii wide nocase
        $alias_2 = "webshell.generic" ascii wide nocase
        $alias_3 = "backdoor.shell" ascii wide nocase
        $alias_4 = "trojan.reverseshell" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHELL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shell tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shell"
        date = "2026-10-16"
    strings:
        $attrib_str = "shell" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Shellcodef (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shellcodef
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHELLCODEF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shellcodef (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shellcodef"
        date = "2026-10-16"
    strings:
        $fam_name = "shellcodef" ascii wide nocase
        $alias_1 = "exploit.shellcode" ascii wide nocase
        $alias_2 = "trojan.shellcodef" ascii wide nocase
        $alias_3 = "win32/exploit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHELLCODEF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shellcodef tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shellcodef"
        date = "2026-10-16"
    strings:
        $attrib_str = "shellcodef" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shellme (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shellme
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHELLME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shellme (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shellme"
        date = "2026-10-16"
    strings:
        $fam_name = "shellme" ascii wide nocase
        $alias_1 = "hacktool.shellme" ascii wide nocase
        $alias_2 = "backdoor.reverseshell" ascii wide nocase
        $alias_3 = "win32/shellme" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHELLME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shellme tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shellme"
        date = "2026-10-16"
    strings:
        $attrib_str = "shellme" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shelma (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shelma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHELMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shelma (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shelma"
        date = "2026-10-16"
    strings:
        $fam_name = "shelma" ascii wide nocase
        $alias_1 = "trojan:win32/shelma" ascii wide nocase
        $alias_2 = "trojan.win32.shelma" ascii wide nocase
        $alias_3 = "backdoor:win32/shelma" ascii wide nocase
        $alias_4 = "win32/shelma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHELMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shelma tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shelma"
        date = "2026-10-16"
    strings:
        $attrib_str = "shelma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Shenzhen (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shenzhen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHENZHEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shenzhen (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shenzhen"
        date = "2026-10-16"
    strings:
        $fam_name = "shenzhen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHENZHEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shenzhen tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shenzhen"
        date = "2026-10-16"
    strings:
        $attrib_str = "shenzhen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Shepher (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shepher
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHEPHER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shepher (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shepher"
        date = "2026-10-16"
    strings:
        $fam_name = "shepher" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHEPHER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shepher tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shepher"
        date = "2026-10-16"
    strings:
        $attrib_str = "shepher" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shezkrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shezkrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHEZKRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shezkrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shezkrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "shezkrypt" ascii wide nocase
        $alias_1 = "ransomware.shezkrypt" ascii wide nocase
        $alias_2 = "trojan-ransom.shezkrypt" ascii wide nocase
        $alias_3 = "win32/shezkrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHEZKRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shezkrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shezkrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "shezkrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shinolock (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shinolock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHINOLOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shinolock (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shinolock"
        date = "2026-10-16"
    strings:
        $fam_name = "shinolock" ascii wide nocase
        $alias_1 = "ransomware.shinolock" ascii wide nocase
        $alias_2 = "win32/shinolock" ascii wide nocase
        $alias_3 = "trojan-ransom.shinolock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHINOLOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shinolock tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shinolock"
        date = "2026-10-16"
    strings:
        $attrib_str = "shinolock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shiotob (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shiotob
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHIOTOB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shiotob (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shiotob"
        date = "2026-10-16"
    strings:
        $fam_name = "shiotob" ascii wide nocase
        $alias_1 = "trojan:win32/shiotob" ascii wide nocase
        $alias_2 = "trojan-banker.win32.shiotob" ascii wide nocase
        $alias_3 = "urlzone" ascii wide nocase
        $alias_4 = "bebloh" ascii wide nocase
        $alias_5 = "win32/shiotob" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHIOTOB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shiotob tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shiotob"
        date = "2026-10-16"
    strings:
        $attrib_str = "shiotob" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Shipup (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shipup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHIPUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shipup (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shipup"
        date = "2026-10-16"
    strings:
        $fam_name = "shipup" ascii wide nocase
        $alias_1 = "adware:win32/shipup" ascii wide nocase
        $alias_2 = "trojan.win32.shipup" ascii wide nocase
        $alias_3 = "win32/shipup" ascii wide nocase
        $alias_4 = "pup.optional.shipup" ascii wide nocase
        $alias_5 = "shipup.downloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHIPUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shipup tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shipup"
        date = "2026-10-16"
    strings:
        $attrib_str = "shipup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Shiz (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shiz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHIZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shiz (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shiz"
        date = "2026-10-16"
    strings:
        $fam_name = "shiz" ascii wide nocase
        $alias_1 = "shiz" ascii wide nocase
        $alias_2 = "win32.shiz" ascii wide nocase
        $alias_3 = "trojan-banker.win32.shiz" ascii wide nocase
        $alias_4 = "shiz.a" ascii wide nocase
        $alias_5 = "shiz.b" ascii wide nocase
        $alias_6 = "shiz_banker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHIZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shiz tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shiz"
        date = "2026-10-16"
    strings:
        $attrib_str = "shiz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Shodi (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shodi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHODI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shodi (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shodi"
        date = "2026-10-16"
    strings:
        $fam_name = "shodi" ascii wide nocase
        $alias_1 = "backdoor:win32/shodi" ascii wide nocase
        $alias_2 = "trojan:win32/shodi" ascii wide nocase
        $alias_3 = "backdoor.shohdi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHODI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shodi tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shodi"
        date = "2026-10-16"
    strings:
        $attrib_str = "shodi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Shopbot (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shopbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHOPBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shopbot (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shopbot"
        date = "2026-10-16"
    strings:
        $fam_name = "shopbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHOPBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shopbot tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shopbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "shopbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Shopperpro (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shopperpro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHOPPERPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shopperpro (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shopperpro"
        date = "2026-10-16"
    strings:
        $fam_name = "shopperpro" ascii wide nocase
        $alias_1 = "adware.shopperpro" ascii wide nocase
        $alias_2 = "pup.shopperpro" ascii wide nocase
        $alias_3 = "win32/adware.shopperpro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHOPPERPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shopperpro tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shopperpro"
        date = "2026-10-16"
    strings:
        $attrib_str = "shopperpro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shopperz (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shopperz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHOPPERZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shopperz (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shopperz"
        date = "2026-10-16"
    strings:
        $fam_name = "shopperz" ascii wide nocase
        $alias_1 = "adware.shopperz" ascii wide nocase
        $alias_2 = "pup.shopperz" ascii wide nocase
        $alias_3 = "browsermodifier:win32/shopperz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHOPPERZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shopperz tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shopperz"
        date = "2026-10-16"
    strings:
        $attrib_str = "shopperz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Shopro (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shopro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHOPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shopro (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shopro"
        date = "2026-10-16"
    strings:
        $fam_name = "shopro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHOPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shopro tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shopro"
        date = "2026-10-16"
    strings:
        $attrib_str = "shopro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Shrejh (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shrejh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHREJH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shrejh (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shrejh"
        date = "2026-10-16"
    strings:
        $fam_name = "shrejh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHREJH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shrejh tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shrejh"
        date = "2026-10-16"
    strings:
        $attrib_str = "shrejh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shufab (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shufab
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHUFAB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shufab (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shufab"
        date = "2026-10-16"
    strings:
        $fam_name = "shufab" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHUFAB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shufab tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shufab"
        date = "2026-10-16"
    strings:
        $attrib_str = "shufab" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shutdown (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shutdown
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHUTDOWN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shutdown (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shutdown"
        date = "2026-10-16"
    strings:
        $fam_name = "shutdown" ascii wide nocase
        $alias_1 = "riskware.shutdown" ascii wide nocase
        $alias_2 = "joke.shutdown" ascii wide nocase
        $alias_3 = "tool.reboot" ascii wide nocase
        $alias_4 = "trojan.shutdown" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHUTDOWN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shutdown tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shutdown"
        date = "2026-10-16"
    strings:
        $attrib_str = "shutdown" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Shutdowner (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shutdowner
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHUTDOWNER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shutdowner (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shutdowner"
        date = "2026-10-16"
    strings:
        $fam_name = "shutdowner" ascii wide nocase
        $alias_1 = "hacktool.shutdowner" ascii wide nocase
        $alias_2 = "riskware.shutdown" ascii wide nocase
        $alias_3 = "win32/dos.shutdown" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHUTDOWNER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shutdowner tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shutdowner"
        date = "2026-10-16"
    strings:
        $attrib_str = "shutdowner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Shyape (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shyape
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHYAPE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shyape (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shyape"
        date = "2026-10-16"
    strings:
        $fam_name = "shyape" ascii wide nocase
        $alias_1 = "adware:win32/shyape" ascii wide nocase
        $alias_2 = "trojan.scar/shyape" ascii wide nocase
        $alias_3 = "pua:win32/shyape" ascii wide nocase
        $alias_4 = "adware.win32.shyape" ascii wide nocase
        $alias_5 = "win32/shyape" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHYAPE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shyape tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shyape"
        date = "2026-10-16"
    strings:
        $attrib_str = "shyape" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Shylock (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/shylock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SHYLOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Shylock (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shylock"
        date = "2026-10-16"
    strings:
        $fam_name = "shylock" ascii wide nocase
        $alias_1 = "shylock" ascii wide nocase
        $alias_2 = "capito" ascii wide nocase
        $alias_3 = "trojan.shylock" ascii wide nocase
        $alias_4 = "win32/shylock" ascii wide nocase
        $alias_5 = "banking.shylock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SHYLOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Shylock tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/shylock"
        date = "2026-10-16"
    strings:
        $attrib_str = "shylock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sigma (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sigma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIGMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sigma (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sigma"
        date = "2026-10-16"
    strings:
        $fam_name = "sigma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIGMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sigma tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sigma"
        date = "2026-10-16"
    strings:
        $attrib_str = "sigma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sign0Fmisery (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sign0fmisery
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIGN0FMISERY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sign0Fmisery (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sign0fmisery"
        date = "2026-10-16"
    strings:
        $fam_name = "sign0fmisery" ascii wide nocase
        $alias_1 = "trojan.sign0fmisery" ascii wide nocase
        $alias_2 = "hacktool.sign0fmisery" ascii wide nocase
        $alias_3 = "win32/sign0fmisery" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIGN0FMISERY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sign0Fmisery tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sign0fmisery"
        date = "2026-10-16"
    strings:
        $attrib_str = "sign0fmisery" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sigrun (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sigrun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIGRUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sigrun (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sigrun"
        date = "2026-10-16"
    strings:
        $fam_name = "sigrun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIGRUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sigrun tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sigrun"
        date = "2026-10-16"
    strings:
        $attrib_str = "sigrun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Siho (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/siho
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIHO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Siho (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/siho"
        date = "2026-10-16"
    strings:
        $fam_name = "siho" ascii wide nocase
        $alias_1 = "trojan.siho" ascii wide nocase
        $alias_2 = "downloader.siho" ascii wide nocase
        $alias_3 = "win32/siho" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIHO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Siho tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/siho"
        date = "2026-10-16"
    strings:
        $attrib_str = "siho" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Silcon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/silcon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SILCON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Silcon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/silcon"
        date = "2026-10-16"
    strings:
        $fam_name = "silcon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SILCON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Silcon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/silcon"
        date = "2026-10-16"
    strings:
        $attrib_str = "silcon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Silentall (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/silentall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SILENTALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Silentall (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/silentall"
        date = "2026-10-16"
    strings:
        $fam_name = "silentall" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SILENTALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Silentall tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/silentall"
        date = "2026-10-16"
    strings:
        $attrib_str = "silentall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Silentinstall (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/silentinstall
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SILENTINSTALL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Silentinstall (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/silentinstall"
        date = "2026-10-16"
    strings:
        $fam_name = "silentinstall" ascii wide nocase
        $alias_1 = "adware.silentinstall" ascii wide nocase
        $alias_2 = "pup.installer" ascii wide nocase
        $alias_3 = "win32/bundler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SILENTINSTALL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Silentinstall tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/silentinstall"
        date = "2026-10-16"
    strings:
        $attrib_str = "silentinstall" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Silly (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/silly
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SILLY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Silly (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/silly"
        date = "2026-10-16"
    strings:
        $fam_name = "silly" ascii wide nocase
        $alias_1 = "worm.sillyfdc" ascii wide nocase
        $alias_2 = "w32/silly" ascii wide nocase
        $alias_3 = "autorun.silly" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SILLY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Silly tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/silly"
        date = "2026-10-16"
    strings:
        $attrib_str = "silly" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sillyfdc (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sillyfdc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SILLYFDC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sillyfdc (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sillyfdc"
        date = "2026-10-16"
    strings:
        $fam_name = "sillyfdc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SILLYFDC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sillyfdc tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sillyfdc"
        date = "2026-10-16"
    strings:
        $attrib_str = "sillyfdc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sillyp2P (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sillyp2p
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SILLYP2P_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sillyp2P (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sillyp2p"
        date = "2026-10-16"
    strings:
        $fam_name = "sillyp2p" ascii wide nocase
        $alias_1 = "worm.p2p.silly" ascii wide nocase
        $alias_2 = "p2p-worm.win32.silly" ascii wide nocase
        $alias_3 = "win32/sillyp2p" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SILLYP2P_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sillyp2P tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sillyp2p"
        date = "2026-10-16"
    strings:
        $attrib_str = "sillyp2p" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sillysharecopy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sillysharecopy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SILLYSHARECOPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sillysharecopy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sillysharecopy"
        date = "2026-10-16"
    strings:
        $fam_name = "sillysharecopy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SILLYSHARECOPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sillysharecopy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sillysharecopy"
        date = "2026-10-16"
    strings:
        $attrib_str = "sillysharecopy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Simbot (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/simbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIMBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Simbot (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simbot"
        date = "2026-10-16"
    strings:
        $fam_name = "simbot" ascii wide nocase
        $alias_1 = "simbot" ascii wide nocase
        $alias_2 = "backdoor:win32/simbot" ascii wide nocase
        $alias_3 = "taidoor" ascii wide nocase
        $alias_4 = "bkdr_simbot" ascii wide nocase
        $alias_5 = "trojan:win32/simbot" ascii wide nocase
        $alias_6 = "taidoor rat" ascii wide nocase
        $alias_7 = "backdoor.win32.simbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIMBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Simbot tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "simbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Simda (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/simda
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIMDA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Simda (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simda"
        date = "2026-10-16"
    strings:
        $fam_name = "simda" ascii wide nocase
        $alias_1 = "simda" ascii wide nocase
        $alias_2 = "win32/simda" ascii wide nocase
        $alias_3 = "trojan.simda" ascii wide nocase
        $alias_4 = "backdoor.simda" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIMDA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Simda tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simda"
        date = "2026-10-16"
    strings:
        $attrib_str = "simda" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Simple (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/simple
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIMPLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Simple (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simple"
        date = "2026-10-16"
    strings:
        $fam_name = "simple" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIMPLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Simple tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simple"
        date = "2026-10-16"
    strings:
        $attrib_str = "simple" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Simpleregistrycleaner (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/simpleregistrycleaner
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIMPLEREGISTRYCLEANER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Simpleregistrycleaner (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simpleregistrycleaner"
        date = "2026-10-16"
    strings:
        $fam_name = "simpleregistrycleaner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIMPLEREGISTRYCLEANER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Simpleregistrycleaner tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simpleregistrycleaner"
        date = "2026-10-16"
    strings:
        $attrib_str = "simpleregistrycleaner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Simplified (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/simplified
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIMPLIFIED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Simplified (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simplified"
        date = "2026-10-16"
    strings:
        $fam_name = "simplified" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIMPLIFIED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Simplified tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simplified"
        date = "2026-10-16"
    strings:
        $attrib_str = "simplified" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Simplyinstaller (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/simplyinstaller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIMPLYINSTALLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Simplyinstaller (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simplyinstaller"
        date = "2026-10-16"
    strings:
        $fam_name = "simplyinstaller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIMPLYINSTALLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Simplyinstaller tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/simplyinstaller"
        date = "2026-10-16"
    strings:
        $attrib_str = "simplyinstaller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Singleclickoptimizer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/singleclickoptimizer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SINGLECLICKOPTIMIZER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Singleclickoptimizer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/singleclickoptimizer"
        date = "2026-10-16"
    strings:
        $fam_name = "singleclickoptimizer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SINGLECLICKOPTIMIZER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Singleclickoptimizer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/singleclickoptimizer"
        date = "2026-10-16"
    strings:
        $attrib_str = "singleclickoptimizer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Singleclickreg (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/singleclickreg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SINGLECLICKREG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Singleclickreg (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/singleclickreg"
        date = "2026-10-16"
    strings:
        $fam_name = "singleclickreg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SINGLECLICKREG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Singleclickreg tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/singleclickreg"
        date = "2026-10-16"
    strings:
        $attrib_str = "singleclickreg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sinique (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sinique
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SINIQUE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sinique (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sinique"
        date = "2026-10-16"
    strings:
        $fam_name = "sinique" ascii wide nocase
        $alias_1 = "sinique trojan" ascii wide nocase
        $alias_2 = "backdoor.sinique" ascii wide nocase
        $alias_3 = "trojan.win32.sinique" ascii wide nocase
        $alias_4 = "sinique 1.0" ascii wide nocase
        $alias_5 = "backdoor:win32/sinique" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SINIQUE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sinique tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sinique"
        date = "2026-10-16"
    strings:
        $attrib_str = "sinique" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sinowal (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sinowal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SINOWAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sinowal (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sinowal"
        date = "2026-10-16"
    strings:
        $fam_name = "sinowal" ascii wide nocase
        $alias_1 = "sinowal" ascii wide nocase
        $alias_2 = "mebroot" ascii wide nocase
        $alias_3 = "torpig" ascii wide nocase
        $alias_4 = "anserin" ascii wide nocase
        $alias_5 = "trojan.sinowal" ascii wide nocase
        $alias_6 = "win32/sinowal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SINOWAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sinowal tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sinowal"
        date = "2026-10-16"
    strings:
        $attrib_str = "sinowal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sinresby (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sinresby
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SINRESBY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sinresby (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sinresby"
        date = "2026-10-16"
    strings:
        $fam_name = "sinresby" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SINRESBY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sinresby tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sinresby"
        date = "2026-10-16"
    strings:
        $attrib_str = "sinresby" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sipia (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sipia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIPIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sipia (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sipia"
        date = "2026-10-16"
    strings:
        $fam_name = "sipia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIPIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sipia tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sipia"
        date = "2026-10-16"
    strings:
        $attrib_str = "sipia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Siplog (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/siplog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIPLOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Siplog (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/siplog"
        date = "2026-10-16"
    strings:
        $fam_name = "siplog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIPLOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Siplog tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/siplog"
        date = "2026-10-16"
    strings:
        $attrib_str = "siplog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sisbot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sisbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SISBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sisbot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sisbot"
        date = "2026-10-16"
    strings:
        $fam_name = "sisbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SISBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sisbot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sisbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "sisbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Siscos (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/siscos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SISCOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Siscos (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/siscos"
        date = "2026-10-16"
    strings:
        $fam_name = "siscos" ascii wide nocase
        $alias_1 = "trojan:win32/siscos" ascii wide nocase
        $alias_2 = "trojan.win32.siscos" ascii wide nocase
        $alias_3 = "win32/siscos" ascii wide nocase
        $alias_4 = "trojan:win32/siscos!rfn" ascii wide nocase
        $alias_5 = "siscos stager" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SISCOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Siscos tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/siscos"
        date = "2026-10-16"
    strings:
        $attrib_str = "siscos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sisron (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sisron
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SISRON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sisron (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sisron"
        date = "2026-10-16"
    strings:
        $fam_name = "sisron" ascii wide nocase
        $alias_1 = "trojan.sisron" ascii wide nocase
        $alias_2 = "downloader.sisron" ascii wide nocase
        $alias_3 = "win32/sisron" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SISRON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sisron tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sisron"
        date = "2026-10-16"
    strings:
        $attrib_str = "sisron" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sivis (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sivis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIVIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sivis (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sivis"
        date = "2026-10-16"
    strings:
        $fam_name = "sivis" ascii wide nocase
        $alias_1 = "sivis" ascii wide nocase
        $alias_2 = "win32.sivis" ascii wide nocase
        $alias_3 = "virus.win32.sivis" ascii wide nocase
        $alias_4 = "w32/sivis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIVIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sivis tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sivis"
        date = "2026-10-16"
    strings:
        $attrib_str = "sivis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sixer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sixer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIXER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sixer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sixer"
        date = "2026-10-16"
    strings:
        $fam_name = "sixer" ascii wide nocase
        $alias_1 = "ransom:win32/sixer" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.sixer" ascii wide nocase
        $alias_3 = "win32/sixer" ascii wide nocase
        $alias_4 = "sixer ransomware" ascii wide nocase
        $alias_5 = "ransom.sixer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIXER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sixer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sixer"
        date = "2026-10-16"
    strings:
        $attrib_str = "sixer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sixmuch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sixmuch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIXMUCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sixmuch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sixmuch"
        date = "2026-10-16"
    strings:
        $fam_name = "sixmuch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIXMUCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sixmuch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sixmuch"
        date = "2026-10-16"
    strings:
        $attrib_str = "sixmuch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sixxpack (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sixxpack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SIXXPACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sixxpack (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sixxpack"
        date = "2026-10-16"
    strings:
        $fam_name = "sixxpack" ascii wide nocase
        $alias_1 = "trojan:win32/sixxpack" ascii wide nocase
        $alias_2 = "trojan:win32/sixxpack.a" ascii wide nocase
        $alias_3 = "virtool:win32/sixxpack" ascii wide nocase
        $alias_4 = "win32/sixxpack" ascii wide nocase
        $alias_5 = "trojan.sixxpack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SIXXPACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sixxpack tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sixxpack"
        date = "2026-10-16"
    strings:
        $attrib_str = "sixxpack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Skeeyah (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/skeeyah
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SKEEYAH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Skeeyah (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/skeeyah"
        date = "2026-10-16"
    strings:
        $fam_name = "skeeyah" ascii wide nocase
        $alias_1 = "skeeyah" ascii wide nocase
        $alias_2 = "trojan:win32/skeeyah" ascii wide nocase
        $alias_3 = "trojan.skeeyah" ascii wide nocase
        $alias_4 = "win32/skeeyah" ascii wide nocase
        $alias_5 = "skeeyah dropper" ascii wide nocase
        $alias_6 = "trojan.win32.skeeyah" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SKEEYAH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Skeeyah tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/skeeyah"
        date = "2026-10-16"
    strings:
        $attrib_str = "skeeyah" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Skillis (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/skillis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SKILLIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Skillis (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/skillis"
        date = "2026-10-16"
    strings:
        $fam_name = "skillis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SKILLIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Skillis tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/skillis"
        date = "2026-10-16"
    strings:
        $attrib_str = "skillis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Skintrim (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/skintrim
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SKINTRIM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Skintrim (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/skintrim"
        date = "2026-10-16"
    strings:
        $fam_name = "skintrim" ascii wide nocase
        $alias_1 = "adware:win32/skintrim" ascii wide nocase
        $alias_2 = "pua:win32/skintrim" ascii wide nocase
        $alias_3 = "trojan.win32.skintrim" ascii wide nocase
        $alias_4 = "win32/skintrim" ascii wide nocase
        $alias_5 = "adware.skintrim" ascii wide nocase
        $alias_6 = "adware:win32/skintrim.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SKINTRIM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Skintrim tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/skintrim"
        date = "2026-10-16"
    strings:
        $attrib_str = "skintrim" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Skorik (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/skorik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SKORIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Skorik (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/skorik"
        date = "2026-10-16"
    strings:
        $fam_name = "skorik" ascii wide nocase
        $alias_1 = "trojan:win32/skorik" ascii wide nocase
        $alias_2 = "trojan.win32.skorik" ascii wide nocase
        $alias_3 = "win32/skorik" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SKORIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Skorik tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/skorik"
        date = "2026-10-16"
    strings:
        $attrib_str = "skorik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Skypespam (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/skypespam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SKYPESPAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Skypespam (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/skypespam"
        date = "2026-10-16"
    strings:
        $fam_name = "skypespam" ascii wide nocase
        $alias_1 = "worm:win32/skypespam" ascii wide nocase
        $alias_2 = "trojan:win32/skypespam" ascii wide nocase
        $alias_3 = "worm:win32/pykspa" ascii wide nocase
        $alias_4 = "trojan.skypespam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SKYPESPAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Skypespam tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/skypespam"
        date = "2026-10-16"
    strings:
        $attrib_str = "skypespam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Slefdel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/slefdel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SLEFDEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Slefdel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slefdel"
        date = "2026-10-16"
    strings:
        $fam_name = "slefdel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SLEFDEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Slefdel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slefdel"
        date = "2026-10-16"
    strings:
        $attrib_str = "slefdel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Slenfbot (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/slenfbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SLENFBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Slenfbot (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slenfbot"
        date = "2026-10-16"
    strings:
        $fam_name = "slenfbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SLENFBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Slenfbot tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slenfbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "slenfbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Slimdrivers (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/slimdrivers
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SLIMDRIVERS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Slimdrivers (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slimdrivers"
        date = "2026-10-16"
    strings:
        $fam_name = "slimdrivers" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SLIMDRIVERS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Slimdrivers tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slimdrivers"
        date = "2026-10-16"
    strings:
        $attrib_str = "slimdrivers" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Slimware (Rogueware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/slimware
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SLIMWARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Slimware (Rogueware)"
        category = "Rogueware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slimware"
        date = "2026-10-16"
    strings:
        $fam_name = "slimware" ascii wide nocase
        $alias_1 = "pua:win32/slimware" ascii wide nocase
        $alias_2 = "pup.optional.slimwareutilities" ascii wide nocase
        $alias_3 = "slimcleaner" ascii wide nocase
        $alias_4 = "driverupdate.slimware" ascii wide nocase
        $alias_5 = "slimware.rogueware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SLIMWARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Slimware tradecraft"
        category = "Rogueware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slimware"
        date = "2026-10-16"
    strings:
        $attrib_str = "slimware" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Slingshot (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/slingshot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SLINGSHOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Slingshot (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slingshot"
        date = "2026-10-16"
    strings:
        $fam_name = "slingshot" ascii wide nocase
        $alias_1 = "apt.slingshot" ascii wide nocase
        $alias_2 = "trojan.slingshot" ascii wide nocase
        $alias_3 = "win32/slingshot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SLINGSHOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Slingshot tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slingshot"
        date = "2026-10-16"
    strings:
        $attrib_str = "slingshot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Slingup (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/slingup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SLINGUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Slingup (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slingup"
        date = "2026-10-16"
    strings:
        $fam_name = "slingup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SLINGUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Slingup tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slingup"
        date = "2026-10-16"
    strings:
        $attrib_str = "slingup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Slipafext (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/slipafext
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SLIPAFEXT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Slipafext (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slipafext"
        date = "2026-10-16"
    strings:
        $fam_name = "slipafext" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SLIPAFEXT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Slipafext tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slipafext"
        date = "2026-10-16"
    strings:
        $attrib_str = "slipafext" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sloddat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sloddat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SLODDAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sloddat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sloddat"
        date = "2026-10-16"
    strings:
        $fam_name = "sloddat" ascii wide nocase
        $alias_1 = "trojan.sloddat" ascii wide nocase
        $alias_2 = "downloader.sloddat" ascii wide nocase
        $alias_3 = "win32/sloddat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SLODDAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sloddat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sloddat"
        date = "2026-10-16"
    strings:
        $attrib_str = "sloddat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Slowpcfighter (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/slowpcfighter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SLOWPCFIGHTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Slowpcfighter (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slowpcfighter"
        date = "2026-10-16"
    strings:
        $fam_name = "slowpcfighter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SLOWPCFIGHTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Slowpcfighter tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slowpcfighter"
        date = "2026-10-16"
    strings:
        $attrib_str = "slowpcfighter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Slugin (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/slugin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SLUGIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Slugin (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slugin"
        date = "2026-10-16"
    strings:
        $fam_name = "slugin" ascii wide nocase
        $alias_1 = "trojandownloader:win32/slugin" ascii wide nocase
        $alias_2 = "trojan:win32/slugin" ascii wide nocase
        $alias_3 = "trojan.slugin" ascii wide nocase
        $alias_4 = "win32/slugin" ascii wide nocase
        $alias_5 = "trojandownloader:win32/slugin.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SLUGIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Slugin tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/slugin"
        date = "2026-10-16"
    strings:
        $attrib_str = "slugin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Smal (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smal (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smal"
        date = "2026-10-16"
    strings:
        $fam_name = "smal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smal tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smal"
        date = "2026-10-16"
    strings:
        $attrib_str = "smal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Smallhttp (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smallhttp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMALLHTTP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smallhttp (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smallhttp"
        date = "2026-10-16"
    strings:
        $fam_name = "smallhttp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMALLHTTP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smallhttp tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smallhttp"
        date = "2026-10-16"
    strings:
        $attrib_str = "smallhttp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Smalo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smalo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMALO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smalo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smalo"
        date = "2026-10-16"
    strings:
        $fam_name = "smalo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMALO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smalo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smalo"
        date = "2026-10-16"
    strings:
        $attrib_str = "smalo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Smartapplicationcontroller (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smartapplicationcontroller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMARTAPPLICATIONCONTROLLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smartapplicationcontroller (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartapplicationcontroller"
        date = "2026-10-16"
    strings:
        $fam_name = "smartapplicationcontroller" ascii wide nocase
        $alias_1 = "rogue.smartappcontrol" ascii wide nocase
        $alias_2 = "pup.fakeav" ascii wide nocase
        $alias_3 = "scareware.win32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMARTAPPLICATIONCONTROLLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smartapplicationcontroller tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartapplicationcontroller"
        date = "2026-10-16"
    strings:
        $attrib_str = "smartapplicationcontroller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Smartapps (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smartapps
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMARTAPPS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smartapps (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartapps"
        date = "2026-10-16"
    strings:
        $fam_name = "smartapps" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMARTAPPS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smartapps tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartapps"
        date = "2026-10-16"
    strings:
        $attrib_str = "smartapps" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Smartassembly (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smartassembly
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMARTASSEMBLY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smartassembly (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartassembly"
        date = "2026-10-16"
    strings:
        $fam_name = "smartassembly" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMARTASSEMBLY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smartassembly tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartassembly"
        date = "2026-10-16"
    strings:
        $attrib_str = "smartassembly" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Smartfortress (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smartfortress
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMARTFORTRESS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smartfortress (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartfortress"
        date = "2026-10-16"
    strings:
        $fam_name = "smartfortress" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMARTFORTRESS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smartfortress tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartfortress"
        date = "2026-10-16"
    strings:
        $attrib_str = "smartfortress" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Smartinstaller (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smartinstaller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMARTINSTALLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smartinstaller (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartinstaller"
        date = "2026-10-16"
    strings:
        $fam_name = "smartinstaller" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMARTINSTALLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smartinstaller tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartinstaller"
        date = "2026-10-16"
    strings:
        $attrib_str = "smartinstaller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Smartpctweaker (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smartpctweaker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMARTPCTWEAKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smartpctweaker (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartpctweaker"
        date = "2026-10-16"
    strings:
        $fam_name = "smartpctweaker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMARTPCTWEAKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smartpctweaker tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smartpctweaker"
        date = "2026-10-16"
    strings:
        $attrib_str = "smartpctweaker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Smbd (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smbd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMBD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smbd (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smbd"
        date = "2026-10-16"
    strings:
        $fam_name = "smbd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMBD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smbd tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smbd"
        date = "2026-10-16"
    strings:
        $attrib_str = "smbd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Smearpasse (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smearpasse
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMEARPASSE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smearpasse (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smearpasse"
        date = "2026-10-16"
    strings:
        $fam_name = "smearpasse" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMEARPASSE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smearpasse tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smearpasse"
        date = "2026-10-16"
    strings:
        $attrib_str = "smearpasse" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Smee (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smee
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMEE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smee (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smee"
        date = "2026-10-16"
    strings:
        $fam_name = "smee" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMEE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smee tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smee"
        date = "2026-10-16"
    strings:
        $attrib_str = "smee" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Smheist (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smheist
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMHEIST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smheist (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smheist"
        date = "2026-10-16"
    strings:
        $fam_name = "smheist" ascii wide nocase
        $alias_1 = "trojan.smheist" ascii wide nocase
        $alias_2 = "banker.smheist" ascii wide nocase
        $alias_3 = "pws.heist" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMHEIST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smheist tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smheist"
        date = "2026-10-16"
    strings:
        $attrib_str = "smheist" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Sminager (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sminager
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMINAGER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sminager (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sminager"
        date = "2026-10-16"
    strings:
        $fam_name = "sminager" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMINAGER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sminager tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sminager"
        date = "2026-10-16"
    strings:
        $attrib_str = "sminager" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Smokeloader (Loader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smokeloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMOKELOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smokeloader (Loader)"
        category = "Loader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smokeloader"
        date = "2026-10-16"
    strings:
        $fam_name = "smokeloader" ascii wide nocase
        $alias_1 = "smokeloader" ascii wide nocase
        $alias_2 = "smoke loader" ascii wide nocase
        $alias_3 = "dofoil" ascii wide nocase
        $alias_4 = "sharapov" ascii wide nocase
        $alias_5 = "trojan.smokeloader" ascii wide nocase
        $alias_6 = "win32/smokeloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMOKELOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smokeloader tradecraft"
        category = "Loader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smokeloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "smokeloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Smominru (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smominru
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMOMINRU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smominru (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smominru"
        date = "2026-10-16"
    strings:
        $fam_name = "smominru" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMOMINRU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smominru tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smominru"
        date = "2026-10-16"
    strings:
        $attrib_str = "smominru" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Smshoax (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smshoax
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMSHOAX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smshoax (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smshoax"
        date = "2026-10-16"
    strings:
        $fam_name = "smshoax" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMSHOAX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smshoax tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smshoax"
        date = "2026-10-16"
    strings:
        $attrib_str = "smshoax" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Smsspy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smsspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMSSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smsspy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smsspy"
        date = "2026-10-16"
    strings:
        $fam_name = "smsspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMSSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smsspy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smsspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "smsspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Smuatemisagi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/smuatemisagi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SMUATEMISAGI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smuatemisagi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smuatemisagi"
        date = "2026-10-16"
    strings:
        $fam_name = "smuatemisagi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SMUATEMISAGI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smuatemisagi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/smuatemisagi"
        date = "2026-10-16"
    strings:
        $attrib_str = "smuatemisagi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Snake (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snake
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNAKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snake (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snake"
        date = "2026-10-16"
    strings:
        $fam_name = "snake" ascii wide nocase
        $alias_1 = "turla snake" ascii wide nocase
        $alias_2 = "uroburos" ascii wide nocase
        $alias_3 = "ouroboros" ascii wide nocase
        $alias_4 = "epic turla" ascii wide nocase
        $alias_5 = "rootkit:win32/snake" ascii wide nocase
        $alias_6 = "snake implant" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNAKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snake tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snake"
        date = "2026-10-16"
    strings:
        $attrib_str = "snake" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Snarasite (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snarasite
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNARASITE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snarasite (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snarasite"
        date = "2026-10-16"
    strings:
        $fam_name = "snarasite" ascii wide nocase
        $alias_1 = "trojan:win32/snarasite" ascii wide nocase
        $alias_2 = "win32/snarasite" ascii wide nocase
        $alias_3 = "snarasite.d!tr" ascii wide nocase
        $alias_4 = "trojan.win32.snarasite" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNARASITE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snarasite tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snarasite"
        date = "2026-10-16"
    strings:
        $attrib_str = "snarasite" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Snare (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snare
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snare (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snare"
        date = "2026-10-16"
    strings:
        $fam_name = "snare" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snare tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snare"
        date = "2026-10-16"
    strings:
        $attrib_str = "snare" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sneepy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sneepy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNEEPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sneepy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sneepy"
        date = "2026-10-16"
    strings:
        $fam_name = "sneepy" ascii wide nocase
        $alias_1 = "trojan.sneepy" ascii wide nocase
        $alias_2 = "downloader.sneepy" ascii wide nocase
        $alias_3 = "win32/sneepy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNEEPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sneepy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sneepy"
        date = "2026-10-16"
    strings:
        $attrib_str = "sneepy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Snifie (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snifie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNIFIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snifie (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snifie"
        date = "2026-10-16"
    strings:
        $fam_name = "snifie" ascii wide nocase
        $alias_1 = "trojan.sniffer.snifie" ascii wide nocase
        $alias_2 = "spyware.snifie" ascii wide nocase
        $alias_3 = "win32/snifie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNIFIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snifie tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snifie"
        date = "2026-10-16"
    strings:
        $attrib_str = "snifie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Snifula (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snifula
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNIFULA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snifula (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snifula"
        date = "2026-10-16"
    strings:
        $fam_name = "snifula" ascii wide nocase
        $alias_1 = "trojan.snifula" ascii wide nocase
        $alias_2 = "spyware.snifula" ascii wide nocase
        $alias_3 = "win32/infostealer.snifula" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNIFULA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snifula tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snifula"
        date = "2026-10-16"
    strings:
        $attrib_str = "snifula" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Snipr (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snipr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNIPR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snipr (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snipr"
        date = "2026-10-16"
    strings:
        $fam_name = "snipr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNIPR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snipr tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snipr"
        date = "2026-10-16"
    strings:
        $attrib_str = "snipr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Snobar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snobar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNOBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snobar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snobar"
        date = "2026-10-16"
    strings:
        $fam_name = "snobar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNOBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snobar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snobar"
        date = "2026-10-16"
    strings:
        $attrib_str = "snobar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Snocry (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snocry
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNOCRY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snocry (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snocry"
        date = "2026-10-16"
    strings:
        $fam_name = "snocry" ascii wide nocase
        $alias_1 = "ransomware.snocry" ascii wide nocase
        $alias_2 = "win32/snocry" ascii wide nocase
        $alias_3 = "trojan-ransom.snocry" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNOCRY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snocry tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snocry"
        date = "2026-10-16"
    strings:
        $attrib_str = "snocry" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Snojan (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snojan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNOJAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snojan (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snojan"
        date = "2026-10-16"
    strings:
        $fam_name = "snojan" ascii wide nocase
        $alias_1 = "trojan.win32.snojan.a" ascii wide nocase
        $alias_2 = "trojan:win32/snojan" ascii wide nocase
        $alias_3 = "trojan.win32.snojan" ascii wide nocase
        $alias_4 = "backdoor:win32/snojan" ascii wide nocase
        $alias_5 = "win32/snojan.gen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNOJAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snojan tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snojan"
        date = "2026-10-16"
    strings:
        $attrib_str = "snojan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Snoload (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snoload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNOLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snoload (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snoload"
        date = "2026-10-16"
    strings:
        $fam_name = "snoload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNOLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snoload tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snoload"
        date = "2026-10-16"
    strings:
        $attrib_str = "snoload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Snorm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snorm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNORM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snorm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snorm"
        date = "2026-10-16"
    strings:
        $fam_name = "snorm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNORM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snorm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snorm"
        date = "2026-10-16"
    strings:
        $attrib_str = "snorm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Snow (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/snow
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SNOW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Snow (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snow"
        date = "2026-10-16"
    strings:
        $fam_name = "snow" ascii wide nocase
        $alias_1 = "ransomware.snow" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.snow" ascii wide nocase
        $alias_3 = "filecoder.snow" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SNOW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Snow tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/snow"
        date = "2026-10-16"
    strings:
        $attrib_str = "snow" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Socelars (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/socelars
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOCELARS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Socelars (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/socelars"
        date = "2026-10-16"
    strings:
        $fam_name = "socelars" ascii wide nocase
        $alias_1 = "socelars" ascii wide nocase
        $alias_2 = "trojan:win32/socelars" ascii wide nocase
        $alias_3 = "trojan.socelars" ascii wide nocase
        $alias_4 = "win32/socelars" ascii wide nocase
        $alias_5 = "socelars stealer" ascii wide nocase
        $alias_6 = "socelars facebook hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOCELARS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Socelars tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/socelars"
        date = "2026-10-16"
    strings:
        $attrib_str = "socelars" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Socks (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/socks
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOCKS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Socks (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/socks"
        date = "2026-10-16"
    strings:
        $fam_name = "socks" ascii wide nocase
        $alias_1 = "socks" ascii wide nocase
        $alias_2 = "trojan:win32/socks" ascii wide nocase
        $alias_3 = "trojanproxy.win32.socks" ascii wide nocase
        $alias_4 = "backdoor.win32.socks" ascii wide nocase
        $alias_5 = "win32/socksproxy" ascii wide nocase
        $alias_6 = "socks trojan" ascii wide nocase
        $alias_7 = "trojan.socks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOCKS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Socks tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/socks"
        date = "2026-10-16"
    strings:
        $attrib_str = "socks" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Socstealer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/socstealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOCSTEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Socstealer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/socstealer"
        date = "2026-10-16"
    strings:
        $fam_name = "socstealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOCSTEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Socstealer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/socstealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "socstealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sofacy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sofacy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOFACY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sofacy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sofacy"
        date = "2026-10-16"
    strings:
        $fam_name = "sofacy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOFACY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sofacy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sofacy"
        date = "2026-10-16"
    strings:
        $attrib_str = "sofacy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Soft32Dl (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/soft32dl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOFT32DL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Soft32Dl (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/soft32dl"
        date = "2026-10-16"
    strings:
        $fam_name = "soft32dl" ascii wide nocase
        $alias_1 = "pua:win32/soft32downloader" ascii wide nocase
        $alias_2 = "adware:win32/soft32" ascii wide nocase
        $alias_3 = "pup.optional.soft32" ascii wide nocase
        $alias_4 = "soft32.downloader" ascii wide nocase
        $alias_5 = "win32/soft32dl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOFT32DL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Soft32Dl tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/soft32dl"
        date = "2026-10-16"
    strings:
        $attrib_str = "soft32dl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Softcdn (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/softcdn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOFTCDN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Softcdn (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softcdn"
        date = "2026-10-16"
    strings:
        $fam_name = "softcdn" ascii wide nocase
        $alias_1 = "pup.softcdn" ascii wide nocase
        $alias_2 = "adware.bundler" ascii wide nocase
        $alias_3 = "riskware.downloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOFTCDN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Softcdn tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softcdn"
        date = "2026-10-16"
    strings:
        $attrib_str = "softcdn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Softcnapp (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/softcnapp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOFTCNAPP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Softcnapp (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softcnapp"
        date = "2026-10-16"
    strings:
        $fam_name = "softcnapp" ascii wide nocase
        $alias_1 = "pua:win32/softcnapp" ascii wide nocase
        $alias_2 = "adware:win32/softcnapp" ascii wide nocase
        $alias_3 = "pup.optional.softcnapp" ascii wide nocase
        $alias_4 = "win32/softcnapp.adware" ascii wide nocase
        $alias_5 = "application.softcnapp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOFTCNAPP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Softcnapp tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softcnapp"
        date = "2026-10-16"
    strings:
        $attrib_str = "softcnapp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Softobase (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/softobase
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOFTOBASE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Softobase (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softobase"
        date = "2026-10-16"
    strings:
        $fam_name = "softobase" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOFTOBASE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Softobase tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softobase"
        date = "2026-10-16"
    strings:
        $attrib_str = "softobase" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Softomate (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/softomate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOFTOMATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Softomate (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softomate"
        date = "2026-10-16"
    strings:
        $fam_name = "softomate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOFTOMATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Softomate tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softomate"
        date = "2026-10-16"
    strings:
        $attrib_str = "softomate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Softonic (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/softonic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOFTONIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Softonic (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softonic"
        date = "2026-10-16"
    strings:
        $fam_name = "softonic" ascii wide nocase
        $alias_1 = "softwarebundler:win32/softonic" ascii wide nocase
        $alias_2 = "pua:win32/softonic" ascii wide nocase
        $alias_3 = "pup.optional.softonic" ascii wide nocase
        $alias_4 = "adware:win32/softonicdownloader" ascii wide nocase
        $alias_5 = "win32/softonic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOFTONIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Softonic tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softonic"
        date = "2026-10-16"
    strings:
        $attrib_str = "softonic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Softpulse (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/softpulse
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOFTPULSE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Softpulse (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softpulse"
        date = "2026-10-16"
    strings:
        $fam_name = "softpulse" ascii wide nocase
        $alias_1 = "adware:win32/softpulse" ascii wide nocase
        $alias_2 = "pua:win32/softpuls" ascii wide nocase
        $alias_3 = "pua.win32.softpulse.ad" ascii wide nocase
        $alias_4 = "adw_pulsoft.sm" ascii wide nocase
        $alias_5 = "win32/softpulse" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOFTPULSE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Softpulse tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/softpulse"
        date = "2026-10-16"
    strings:
        $attrib_str = "softpulse" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sogou (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sogou
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOGOU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sogou (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sogou"
        date = "2026-10-16"
    strings:
        $fam_name = "sogou" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOGOU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sogou tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sogou"
        date = "2026-10-16"
    strings:
        $attrib_str = "sogou" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sohanad (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sohanad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOHANAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sohanad (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sohanad"
        date = "2026-10-16"
    strings:
        $fam_name = "sohanad" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOHANAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sohanad tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sohanad"
        date = "2026-10-16"
    strings:
        $attrib_str = "sohanad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sokuxuan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sokuxuan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOKUXUAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sokuxuan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sokuxuan"
        date = "2026-10-16"
    strings:
        $fam_name = "sokuxuan" ascii wide nocase
        $alias_1 = "adware.sokuxuan" ascii wide nocase
        $alias_2 = "pup.sokuxuan" ascii wide nocase
        $alias_3 = "browserhijacker.sokuxuan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOKUXUAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sokuxuan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sokuxuan"
        date = "2026-10-16"
    strings:
        $attrib_str = "sokuxuan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Soldier (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/soldier
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOLDIER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Soldier (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/soldier"
        date = "2026-10-16"
    strings:
        $fam_name = "soldier" ascii wide nocase
        $alias_1 = "trojan.soldier" ascii wide nocase
        $alias_2 = "backdoor.apt.soldier" ascii wide nocase
        $alias_3 = "win32/soldier" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOLDIER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Soldier tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/soldier"
        date = "2026-10-16"
    strings:
        $attrib_str = "soldier" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Somoto (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/somoto
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOMOTO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Somoto (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/somoto"
        date = "2026-10-16"
    strings:
        $fam_name = "somoto" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOMOTO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Somoto tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/somoto"
        date = "2026-10-16"
    strings:
        $attrib_str = "somoto" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sonbokli (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sonbokli
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SONBOKLI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sonbokli (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sonbokli"
        date = "2026-10-16"
    strings:
        $fam_name = "sonbokli" ascii wide nocase
        $alias_1 = "trojan.sonbokli" ascii wide nocase
        $alias_2 = "downloader.sonbokli" ascii wide nocase
        $alias_3 = "win32/sonbokli" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SONBOKLI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sonbokli tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sonbokli"
        date = "2026-10-16"
    strings:
        $attrib_str = "sonbokli" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sorcurat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sorcurat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SORCURAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sorcurat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sorcurat"
        date = "2026-10-16"
    strings:
        $fam_name = "sorcurat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SORCURAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sorcurat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sorcurat"
        date = "2026-10-16"
    strings:
        $attrib_str = "sorcurat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Soul (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/soul
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOUL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Soul (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/soul"
        date = "2026-10-16"
    strings:
        $fam_name = "soul" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOUL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Soul tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/soul"
        date = "2026-10-16"
    strings:
        $attrib_str = "soul" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Soulclose (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/soulclose
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SOULCLOSE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Soulclose (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/soulclose"
        date = "2026-10-16"
    strings:
        $fam_name = "soulclose" ascii wide nocase
        $alias_1 = "adware.soulclose" ascii wide nocase
        $alias_2 = "pup.soulclose" ascii wide nocase
        $alias_3 = "browsermodifier:win32/soulclose" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SOULCLOSE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Soulclose tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/soulclose"
        date = "2026-10-16"
    strings:
        $attrib_str = "soulclose" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Spamer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spamer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPAMER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spamer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spamer"
        date = "2026-10-16"
    strings:
        $fam_name = "spamer" ascii wide nocase
        $alias_1 = "riskware.spamer" ascii wide nocase
        $alias_2 = "trojan-spammer" ascii wide nocase
        $alias_3 = "tool.bulkemailer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPAMER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spamer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spamer"
        date = "2026-10-16"
    strings:
        $attrib_str = "spamer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Spamha (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spamha
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPAMHA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spamha (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spamha"
        date = "2026-10-16"
    strings:
        $fam_name = "spamha" ascii wide nocase
        $alias_1 = "trojan.spambot.spamha" ascii wide nocase
        $alias_2 = "spamtool.spamha" ascii wide nocase
        $alias_3 = "win32/spamha" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPAMHA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spamha tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spamha"
        date = "2026-10-16"
    strings:
        $attrib_str = "spamha" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Spammy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spammy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPAMMY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spammy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spammy"
        date = "2026-10-16"
    strings:
        $fam_name = "spammy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPAMMY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spammy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spammy"
        date = "2026-10-16"
    strings:
        $attrib_str = "spammy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Specialsearchoffer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/specialsearchoffer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPECIALSEARCHOFFER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Specialsearchoffer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/specialsearchoffer"
        date = "2026-10-16"
    strings:
        $fam_name = "specialsearchoffer" ascii wide nocase
        $alias_1 = "adware.specialsearch" ascii wide nocase
        $alias_2 = "browserhijacker.specialsearchoffer" ascii wide nocase
        $alias_3 = "pup.specialsearch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPECIALSEARCHOFFER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Specialsearchoffer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/specialsearchoffer"
        date = "2026-10-16"
    strings:
        $attrib_str = "specialsearchoffer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Spector (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spector
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPECTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spector (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spector"
        date = "2026-10-16"
    strings:
        $fam_name = "spector" ascii wide nocase
        $alias_1 = "spyware.spector" ascii wide nocase
        $alias_2 = "riskware.spectorpro" ascii wide nocase
        $alias_3 = "stalkerware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPECTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spector tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spector"
        date = "2026-10-16"
    strings:
        $attrib_str = "spector" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spectorpro (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spectorpro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPECTORPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spectorpro (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spectorpro"
        date = "2026-10-16"
    strings:
        $fam_name = "spectorpro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPECTORPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spectorpro tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spectorpro"
        date = "2026-10-16"
    strings:
        $attrib_str = "spectorpro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spectre (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spectre
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPECTRE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spectre (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spectre"
        date = "2026-10-16"
    strings:
        $fam_name = "spectre" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPECTRE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spectre tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spectre"
        date = "2026-10-16"
    strings:
        $attrib_str = "spectre" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Specx (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/specx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPECX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Specx (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/specx"
        date = "2026-10-16"
    strings:
        $fam_name = "specx" ascii wide nocase
        $alias_1 = "trojan.specx" ascii wide nocase
        $alias_2 = "downloader.specx" ascii wide nocase
        $alias_3 = "win32/specx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPECX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Specx tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/specx"
        date = "2026-10-16"
    strings:
        $attrib_str = "specx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Speed (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/speed
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPEED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Speed (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speed"
        date = "2026-10-16"
    strings:
        $fam_name = "speed" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPEED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Speed tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speed"
        date = "2026-10-16"
    strings:
        $attrib_str = "speed" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Speedbit (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/speedbit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPEEDBIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Speedbit (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speedbit"
        date = "2026-10-16"
    strings:
        $fam_name = "speedbit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPEEDBIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Speedbit tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speedbit"
        date = "2026-10-16"
    strings:
        $attrib_str = "speedbit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Speedcat (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/speedcat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPEEDCAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Speedcat (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speedcat"
        date = "2026-10-16"
    strings:
        $fam_name = "speedcat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPEEDCAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Speedcat tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speedcat"
        date = "2026-10-16"
    strings:
        $attrib_str = "speedcat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Speedchecker (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/speedchecker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPEEDCHECKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Speedchecker (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speedchecker"
        date = "2026-10-16"
    strings:
        $fam_name = "speedchecker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPEEDCHECKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Speedchecker tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speedchecker"
        date = "2026-10-16"
    strings:
        $attrib_str = "speedchecker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Speedingupmypc (Pup)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/speedingupmypc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPEEDINGUPMYPC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Speedingupmypc (Pup)"
        category = "Pup"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speedingupmypc"
        date = "2026-10-16"
    strings:
        $fam_name = "speedingupmypc" ascii wide nocase
        $alias_1 = "pua:win32/speedingupmypc" ascii wide nocase
        $alias_2 = "rogue:win32/speedingupmypc" ascii wide nocase
        $alias_3 = "pup.optional.speedingupmypc" ascii wide nocase
        $alias_4 = "speedingupmypc.scareware" ascii wide nocase
        $alias_5 = "speedupmypc.rogue" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPEEDINGUPMYPC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Speedingupmypc tradecraft"
        category = "Pup"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speedingupmypc"
        date = "2026-10-16"
    strings:
        $attrib_str = "speedingupmypc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Speesipro (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/speesipro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPEESIPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Speesipro (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speesipro"
        date = "2026-10-16"
    strings:
        $fam_name = "speesipro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPEESIPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Speesipro tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/speesipro"
        date = "2026-10-16"
    strings:
        $attrib_str = "speesipro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sperolz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sperolz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPEROLZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sperolz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sperolz"
        date = "2026-10-16"
    strings:
        $fam_name = "sperolz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPEROLZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sperolz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sperolz"
        date = "2026-10-16"
    strings:
        $attrib_str = "sperolz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Spesr (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spesr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPESR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spesr (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spesr"
        date = "2026-10-16"
    strings:
        $fam_name = "spesr" ascii wide nocase
        $alias_1 = "trojan:win32/spesr" ascii wide nocase
        $alias_2 = "trojan:win32/spesr.a" ascii wide nocase
        $alias_3 = "trojan:win32/spesr.b" ascii wide nocase
        $alias_4 = "win32/spesr" ascii wide nocase
        $alias_5 = "trojan.spesr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPESR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spesr tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spesr"
        date = "2026-10-16"
    strings:
        $attrib_str = "spesr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sphinx (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sphinx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPHINX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sphinx (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sphinx"
        date = "2026-10-16"
    strings:
        $fam_name = "sphinx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPHINX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sphinx tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sphinx"
        date = "2026-10-16"
    strings:
        $attrib_str = "sphinx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Spigot (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spigot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPIGOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spigot (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spigot"
        date = "2026-10-16"
    strings:
        $fam_name = "spigot" ascii wide nocase
        $alias_1 = "browsermodifier:win32/spigot" ascii wide nocase
        $alias_2 = "adware:win32/spigot" ascii wide nocase
        $alias_3 = "win32/spigot" ascii wide nocase
        $alias_4 = "pup.optional.spigot" ascii wide nocase
        $alias_5 = "adware.spigot" ascii wide nocase
        $alias_6 = "spigot.coupondropdown" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPIGOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spigot tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spigot"
        date = "2026-10-16"
    strings:
        $attrib_str = "spigot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spnr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spnr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPNR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spnr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spnr"
        date = "2026-10-16"
    strings:
        $fam_name = "spnr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPNR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spnr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spnr"
        date = "2026-10-16"
    strings:
        $attrib_str = "spnr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Spoofer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spoofer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPOOFER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spoofer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spoofer"
        date = "2026-10-16"
    strings:
        $fam_name = "spoofer" ascii wide nocase
        $alias_1 = "hacktool.spoofer" ascii wide nocase
        $alias_2 = "riskware.spoofer" ascii wide nocase
        $alias_3 = "tool.win32.spoofer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPOOFER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spoofer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spoofer"
        date = "2026-10-16"
    strings:
        $attrib_str = "spoofer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spook (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spook
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPOOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spook (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spook"
        date = "2026-10-16"
    strings:
        $fam_name = "spook" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPOOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spook tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spook"
        date = "2026-10-16"
    strings:
        $attrib_str = "spook" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Spora (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spora
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPORA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spora (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spora"
        date = "2026-10-16"
    strings:
        $fam_name = "spora" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPORA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spora tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spora"
        date = "2026-10-16"
    strings:
        $attrib_str = "spora" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Springtech (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/springtech
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPRINGTECH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Springtech (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/springtech"
        date = "2026-10-16"
    strings:
        $fam_name = "springtech" ascii wide nocase
        $alias_1 = "adware.springtech" ascii wide nocase
        $alias_2 = "pup.springtech" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPRINGTECH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Springtech tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/springtech"
        date = "2026-10-16"
    strings:
        $attrib_str = "springtech" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spyagent (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spyagent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYAGENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spyagent (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spyagent"
        date = "2026-10-16"
    strings:
        $fam_name = "spyagent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYAGENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spyagent tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spyagent"
        date = "2026-10-16"
    strings:
        $attrib_str = "spyagent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spybot (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spybot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spybot (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spybot"
        date = "2026-10-16"
    strings:
        $fam_name = "spybot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spybot tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spybot"
        date = "2026-10-16"
    strings:
        $attrib_str = "spybot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spyboter (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spyboter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYBOTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spyboter (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spyboter"
        date = "2026-10-16"
    strings:
        $fam_name = "spyboter" ascii wide nocase
        $alias_1 = "trojan.keylogger.spyboter" ascii wide nocase
        $alias_2 = "spyware.spyboter" ascii wide nocase
        $alias_3 = "win32/spyboter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYBOTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spyboter tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spyboter"
        date = "2026-10-16"
    strings:
        $attrib_str = "spyboter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spyeye (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spyeye
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYEYE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spyeye (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spyeye"
        date = "2026-10-16"
    strings:
        $fam_name = "spyeye" ascii wide nocase
        $alias_1 = "trojan:win32/spyeye" ascii wide nocase
        $alias_2 = "win32/spyeye" ascii wide nocase
        $alias_3 = "trojan.spyeye" ascii wide nocase
        $alias_4 = "spyeye bot" ascii wide nocase
        $alias_5 = "tspy_spyeye" ascii wide nocase
        $alias_6 = "spyeye.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYEYE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spyeye tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spyeye"
        date = "2026-10-16"
    strings:
        $attrib_str = "spyeye" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Spygate (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spygate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYGATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spygate (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spygate"
        date = "2026-10-16"
    strings:
        $fam_name = "spygate" ascii wide nocase
        $alias_1 = "spygate" ascii wide nocase
        $alias_2 = "spygate-rat" ascii wide nocase
        $alias_3 = "backdoor.spygate" ascii wide nocase
        $alias_4 = "win32/spygate" ascii wide nocase
        $alias_5 = "spy-net fork" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYGATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spygate tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spygate"
        date = "2026-10-16"
    strings:
        $attrib_str = "spygate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Spynet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spynet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYNET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spynet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spynet"
        date = "2026-10-16"
    strings:
        $fam_name = "spynet" ascii wide nocase
        $alias_1 = "backdoor.spynet" ascii wide nocase
        $alias_2 = "trojan.spynet" ascii wide nocase
        $alias_3 = "win32/spynetrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYNET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spynet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spynet"
        date = "2026-10-16"
    strings:
        $attrib_str = "spynet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Spynomore (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spynomore
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYNOMORE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spynomore (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spynomore"
        date = "2026-10-16"
    strings:
        $fam_name = "spynomore" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYNOMORE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spynomore tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spynomore"
        date = "2026-10-16"
    strings:
        $attrib_str = "spynomore" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Spypro (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spypro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spypro (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spypro"
        date = "2026-10-16"
    strings:
        $fam_name = "spypro" ascii wide nocase
        $alias_1 = "rogue.spypro" ascii wide nocase
        $alias_2 = "scareware.spypro" ascii wide nocase
        $alias_3 = "fakeav.spypro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spypro tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spypro"
        date = "2026-10-16"
    strings:
        $attrib_str = "spypro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Spyrecon (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spyrecon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYRECON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spyrecon (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spyrecon"
        date = "2026-10-16"
    strings:
        $fam_name = "spyrecon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYRECON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spyrecon tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spyrecon"
        date = "2026-10-16"
    strings:
        $attrib_str = "spyrecon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spyrix (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spyrix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYRIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spyrix (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spyrix"
        date = "2026-10-16"
    strings:
        $fam_name = "spyrix" ascii wide nocase
        $alias_1 = "riskware.spyrix" ascii wide nocase
        $alias_2 = "keylogger.spyrix" ascii wide nocase
        $alias_3 = "monitor.spyrix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYRIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spyrix tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spyrix"
        date = "2026-10-16"
    strings:
        $attrib_str = "spyrix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spytech (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spytech
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYTECH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spytech (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spytech"
        date = "2026-10-16"
    strings:
        $fam_name = "spytech" ascii wide nocase
        $alias_1 = "riskware.spytech" ascii wide nocase
        $alias_2 = "spyware.spytech" ascii wide nocase
        $alias_3 = "monitor.win32.spytech" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYTECH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spytech tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spytech"
        date = "2026-10-16"
    strings:
        $attrib_str = "spytech" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Spytector (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spytector
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYTECTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spytector (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spytector"
        date = "2026-10-16"
    strings:
        $fam_name = "spytector" ascii wide nocase
        $alias_1 = "spytector keylogger" ascii wide nocase
        $alias_2 = "spytector surveillance" ascii wide nocase
        $alias_3 = "spytector.delphi" ascii wide nocase
        $alias_4 = "monitoringtool:win32/spytector" ascii wide nocase
        $alias_5 = "trojan.spytector" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYTECTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spytector tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spytector"
        date = "2026-10-16"
    strings:
        $attrib_str = "spytector" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Spywork (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/spywork
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SPYWORK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Spywork (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spywork"
        date = "2026-10-16"
    strings:
        $fam_name = "spywork" ascii wide nocase
        $alias_1 = "spyware.spywork" ascii wide nocase
        $alias_2 = "trojanspy.spywork" ascii wide nocase
        $alias_3 = "win32/spywork" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SPYWORK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Spywork tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/spywork"
        date = "2026-10-16"
    strings:
        $attrib_str = "spywork" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sqlcrack (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sqlcrack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SQLCRACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sqlcrack (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sqlcrack"
        date = "2026-10-16"
    strings:
        $fam_name = "sqlcrack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SQLCRACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sqlcrack tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sqlcrack"
        date = "2026-10-16"
    strings:
        $attrib_str = "sqlcrack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Squarenet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/squarenet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SQUARENET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Squarenet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/squarenet"
        date = "2026-10-16"
    strings:
        $fam_name = "squarenet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SQUARENET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Squarenet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/squarenet"
        date = "2026-10-16"
    strings:
        $attrib_str = "squarenet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ssebot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ssebot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SSEBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ssebot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ssebot"
        date = "2026-10-16"
    strings:
        $fam_name = "ssebot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SSEBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ssebot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ssebot"
        date = "2026-10-16"
    strings:
        $attrib_str = "ssebot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ssprotect (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ssprotect
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SSPROTECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ssprotect (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ssprotect"
        date = "2026-10-16"
    strings:
        $fam_name = "ssprotect" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SSPROTECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ssprotect tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ssprotect"
        date = "2026-10-16"
    strings:
        $attrib_str = "ssprotect" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Staem (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/staem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STAEM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Staem (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/staem"
        date = "2026-10-16"
    strings:
        $fam_name = "staem" ascii wide nocase
        $alias_1 = "trojan.steamstealer" ascii wide nocase
        $alias_2 = "pws.steam" ascii wide nocase
        $alias_3 = "phish.staem" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STAEM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Staem tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/staem"
        date = "2026-10-16"
    strings:
        $attrib_str = "staem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Staget (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/staget
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STAGET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Staget (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/staget"
        date = "2026-10-16"
    strings:
        $fam_name = "staget" ascii wide nocase
        $alias_1 = "trojan.staget" ascii wide nocase
        $alias_2 = "downloader.staget" ascii wide nocase
        $alias_3 = "win32/staget" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STAGET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Staget tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/staget"
        date = "2026-10-16"
    strings:
        $attrib_str = "staget" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Stagol (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stagol
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STAGOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stagol (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stagol"
        date = "2026-10-16"
    strings:
        $fam_name = "stagol" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STAGOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stagol tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stagol"
        date = "2026-10-16"
    strings:
        $attrib_str = "stagol" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Stalk (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stalk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STALK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stalk (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stalk"
        date = "2026-10-16"
    strings:
        $fam_name = "stalk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STALK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stalk tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stalk"
        date = "2026-10-16"
    strings:
        $attrib_str = "stalk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Stampado (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stampado
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STAMPADO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stampado (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stampado"
        date = "2026-10-16"
    strings:
        $fam_name = "stampado" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STAMPADO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stampado tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stampado"
        date = "2026-10-16"
    strings:
        $attrib_str = "stampado" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Stantinko (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stantinko
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STANTINKO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stantinko (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stantinko"
        date = "2026-10-16"
    strings:
        $fam_name = "stantinko" ascii wide nocase
        $alias_1 = "trojan:win32/stantinko" ascii wide nocase
        $alias_2 = "win32/coinminer.stantinko" ascii wide nocase
        $alias_3 = "win64/coinminer.stantinko" ascii wide nocase
        $alias_4 = "trojan.win32.stantinko" ascii wide nocase
        $alias_5 = "stantinko botnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STANTINKO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stantinko tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stantinko"
        date = "2026-10-16"
    strings:
        $attrib_str = "stantinko" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Startp (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/startp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STARTP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Startp (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/startp"
        date = "2026-10-16"
    strings:
        $fam_name = "startp" ascii wide nocase
        $alias_1 = "trojan.startpage" ascii wide nocase
        $alias_2 = "trojan.startp" ascii wide nocase
        $alias_3 = "win32/startp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STARTP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Startp tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/startp"
        date = "2026-10-16"
    strings:
        $attrib_str = "startp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Startpa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/startpa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STARTPA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Startpa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/startpa"
        date = "2026-10-16"
    strings:
        $fam_name = "startpa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STARTPA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Startpa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/startpa"
        date = "2026-10-16"
    strings:
        $attrib_str = "startpa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Startserv (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/startserv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STARTSERV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Startserv (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/startserv"
        date = "2026-10-16"
    strings:
        $fam_name = "startserv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STARTSERV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Startserv tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/startserv"
        date = "2026-10-16"
    strings:
        $attrib_str = "startserv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Startsurf (Browser_Hijacker)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/startsurf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STARTSURF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Startsurf (Browser_Hijacker)"
        category = "Browser_Hijacker"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/startsurf"
        date = "2026-10-16"
    strings:
        $fam_name = "startsurf" ascii wide nocase
        $alias_1 = "browsermodifier:win32/startsurf" ascii wide nocase
        $alias_2 = "adware:win32/startsurf" ascii wide nocase
        $alias_3 = "win32/startsurf" ascii wide nocase
        $alias_4 = "pup.optional.startsurf" ascii wide nocase
        $alias_5 = "adware.startsurf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STARTSURF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Startsurf tradecraft"
        category = "Browser_Hijacker"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/startsurf"
        date = "2026-10-16"
    strings:
        $attrib_str = "startsurf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Staser (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/staser
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STASER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Staser (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/staser"
        date = "2026-10-16"
    strings:
        $fam_name = "staser" ascii wide nocase
        $alias_1 = "trojan:win32/staser" ascii wide nocase
        $alias_2 = "trojandownloader:win32/staser" ascii wide nocase
        $alias_3 = "trojan.staser" ascii wide nocase
        $alias_4 = "win32/staser" ascii wide nocase
        $alias_5 = "trojan:win32/staser.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STASER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Staser tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/staser"
        date = "2026-10-16"
    strings:
        $attrib_str = "staser" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Steam (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/steam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STEAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Steam (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/steam"
        date = "2026-10-16"
    strings:
        $fam_name = "steam" ascii wide nocase
        $alias_1 = "trojan:win32/steamstealer" ascii wide nocase
        $alias_2 = "pws:win32/steam" ascii wide nocase
        $alias_3 = "trojan:win32/steamstealer!rfn" ascii wide nocase
        $alias_4 = "trojan-psw.win32.steam" ascii wide nocase
        $alias_5 = "win32/steamstealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STEAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Steam tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/steam"
        date = "2026-10-16"
    strings:
        $attrib_str = "steam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Stegvob (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stegvob
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STEGVOB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stegvob (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stegvob"
        date = "2026-10-16"
    strings:
        $fam_name = "stegvob" ascii wide nocase
        $alias_1 = "trojan.stegvob" ascii wide nocase
        $alias_2 = "downloader.steganography" ascii wide nocase
        $alias_3 = "win32/stegvob" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STEGVOB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stegvob tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stegvob"
        date = "2026-10-16"
    strings:
        $attrib_str = "stegvob" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Stercogs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stercogs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STERCOGS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stercogs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stercogs"
        date = "2026-10-16"
    strings:
        $fam_name = "stercogs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STERCOGS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stercogs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stercogs"
        date = "2026-10-16"
    strings:
        $attrib_str = "stercogs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Stimilik (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stimilik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STIMILIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stimilik (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stimilik"
        date = "2026-10-16"
    strings:
        $fam_name = "stimilik" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STIMILIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stimilik tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stimilik"
        date = "2026-10-16"
    strings:
        $attrib_str = "stimilik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Stocde (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stocde
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STOCDE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stocde (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stocde"
        date = "2026-10-16"
    strings:
        $fam_name = "stocde" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STOCDE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stocde tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stocde"
        date = "2026-10-16"
    strings:
        $attrib_str = "stocde" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Stop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stop"
        date = "2026-10-16"
    strings:
        $fam_name = "stop" ascii wide nocase
        $alias_1 = "stop/djvu" ascii wide nocase
        $alias_2 = "djvu ransomware" ascii wide nocase
        $alias_3 = "ransomware:win32/stop" ascii wide nocase
        $alias_4 = "trojan-ransom.win32.stop" ascii wide nocase
        $alias_5 = "djvu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stop"
        date = "2026-10-16"
    strings:
        $attrib_str = "stop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Storm (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/storm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STORM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Storm (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/storm"
        date = "2026-10-16"
    strings:
        $fam_name = "storm" ascii wide nocase
        $alias_1 = "storm" ascii wide nocase
        $alias_2 = "storm worm" ascii wide nocase
        $alias_3 = "peed" ascii wide nocase
        $alias_4 = "nuwar" ascii wide nocase
        $alias_5 = "w32/storm" ascii wide nocase
        $alias_6 = "dorf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STORM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Storm tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/storm"
        date = "2026-10-16"
    strings:
        $attrib_str = "storm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Stormattack (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stormattack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STORMATTACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stormattack (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stormattack"
        date = "2026-10-16"
    strings:
        $fam_name = "stormattack" ascii wide nocase
        $alias_1 = "trojan:win32/stormattack" ascii wide nocase
        $alias_2 = "trojan:win32/stormattack!mtb" ascii wide nocase
        $alias_3 = "stormattack" ascii wide nocase
        $alias_4 = "win32/stormattack" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STORMATTACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stormattack tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stormattack"
        date = "2026-10-16"
    strings:
        $attrib_str = "stormattack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Strat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/strat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Strat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/strat"
        date = "2026-10-16"
    strings:
        $fam_name = "strat" ascii wide nocase
        $alias_1 = "trojan.strat" ascii wide nocase
        $alias_2 = "downloader.strat" ascii wide nocase
        $alias_3 = "win32/strat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Strat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/strat"
        date = "2026-10-16"
    strings:
        $attrib_str = "strat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Stream_Rat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stream_rat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STREAM_RAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stream_Rat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stream_rat"
        date = "2026-10-16"
    strings:
        $fam_name = "stream_rat" ascii wide nocase
        $alias_1 = "streamrat" ascii wide nocase
        $alias_2 = "backdoor.streamrat" ascii wide nocase
        $alias_3 = "trojan.streamrat" ascii wide nocase
        $alias_4 = "backdoor:win32/streamrat" ascii wide nocase
        $alias_5 = "stream rat 1.0" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STREAM_RAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stream_Rat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stream_rat"
        date = "2026-10-16"
    strings:
        $attrib_str = "stream_rat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Streamer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/streamer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STREAMER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Streamer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/streamer"
        date = "2026-10-16"
    strings:
        $fam_name = "streamer" ascii wide nocase
        $alias_1 = "adware.streamer" ascii wide nocase
        $alias_2 = "pup.streamer" ascii wide nocase
        $alias_3 = "browserhijacker.streamer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STREAMER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Streamer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/streamer"
        date = "2026-10-16"
    strings:
        $attrib_str = "streamer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Streespyer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/streespyer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STREESPYER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Streespyer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/streespyer"
        date = "2026-10-16"
    strings:
        $fam_name = "streespyer" ascii wide nocase
        $alias_1 = "trojan.streespyer" ascii wide nocase
        $alias_2 = "spyware.streespyer" ascii wide nocase
        $alias_3 = "pws.win32.streespyer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STREESPYER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Streespyer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/streespyer"
        date = "2026-10-16"
    strings:
        $attrib_str = "streespyer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Strictorcrtd (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/strictorcrtd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STRICTORCRTD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Strictorcrtd (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/strictorcrtd"
        date = "2026-10-16"
    strings:
        $fam_name = "strictorcrtd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STRICTORCRTD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Strictorcrtd tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/strictorcrtd"
        date = "2026-10-16"
    strings:
        $attrib_str = "strictorcrtd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Strongpity (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/strongpity
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STRONGPITY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Strongpity (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/strongpity"
        date = "2026-10-16"
    strings:
        $fam_name = "strongpity" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STRONGPITY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Strongpity tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/strongpity"
        date = "2026-10-16"
    strings:
        $attrib_str = "strongpity" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Stubrc (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stubrc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STUBRC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stubrc (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stubrc"
        date = "2026-10-16"
    strings:
        $fam_name = "stubrc" ascii wide nocase
        $alias_1 = "trojan-dropper.msil.stubrc" ascii wide nocase
        $alias_2 = "backdoor:win32/stubrc" ascii wide nocase
        $alias_3 = "trojan:msil/stubrc" ascii wide nocase
        $alias_4 = "dropper.msil.stubrc" ascii wide nocase
        $alias_5 = "win32/stubrc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STUBRC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stubrc tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stubrc"
        date = "2026-10-16"
    strings:
        $attrib_str = "stubrc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Stufffull (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stufffull
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STUFFFULL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stufffull (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stufffull"
        date = "2026-10-16"
    strings:
        $fam_name = "stufffull" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STUFFFULL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stufffull tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stufffull"
        date = "2026-10-16"
    strings:
        $attrib_str = "stufffull" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Subroate (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/subroate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SUBROATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Subroate (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/subroate"
        date = "2026-10-16"
    strings:
        $fam_name = "subroate" ascii wide nocase
        $alias_1 = "trojan.subroate" ascii wide nocase
        $alias_2 = "downloader.subroate" ascii wide nocase
        $alias_3 = "win32/subroate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SUBROATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Subroate tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/subroate"
        date = "2026-10-16"
    strings:
        $attrib_str = "subroate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Subseven (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/subseven
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SUBSEVEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Subseven (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/subseven"
        date = "2026-10-16"
    strings:
        $fam_name = "subseven" ascii wide nocase
        $alias_1 = "sub7" ascii wide nocase
        $alias_2 = "backdoor.subseven" ascii wide nocase
        $alias_3 = "sub7 gold" ascii wide nocase
        $alias_4 = "trojan.subseven" ascii wide nocase
        $alias_5 = "backdoor:win32/subseven" ascii wide nocase
        $alias_6 = "sub7 2.2" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SUBSEVEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Subseven tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/subseven"
        date = "2026-10-16"
    strings:
        $attrib_str = "subseven" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Subti (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/subti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SUBTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Subti (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/subti"
        date = "2026-10-16"
    strings:
        $fam_name = "subti" ascii wide nocase
        $alias_1 = "trojandownloader:win32/subti" ascii wide nocase
        $alias_2 = "trojan:win32/subti" ascii wide nocase
        $alias_3 = "trojan.subti" ascii wide nocase
        $alias_4 = "win32/subti" ascii wide nocase
        $alias_5 = "trojandownloader:win32/subti.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SUBTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Subti tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/subti"
        date = "2026-10-16"
    strings:
        $attrib_str = "subti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Sugar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sugar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SUGAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sugar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sugar"
        date = "2026-10-16"
    strings:
        $fam_name = "sugar" ascii wide nocase
        $alias_1 = "ransom:win32/sugar" ascii wide nocase
        $alias_2 = "ransom.encoded01" ascii wide nocase
        $alias_3 = "win32/sugar" ascii wide nocase
        $alias_4 = "encoded01" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SUGAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sugar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sugar"
        date = "2026-10-16"
    strings:
        $attrib_str = "sugar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Suite (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/suite
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SUITE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Suite (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/suite"
        date = "2026-10-16"
    strings:
        $fam_name = "suite" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SUITE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Suite tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/suite"
        date = "2026-10-16"
    strings:
        $attrib_str = "suite" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Suixin (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/suixin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SUIXIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Suixin (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/suixin"
        date = "2026-10-16"
    strings:
        $fam_name = "suixin" ascii wide nocase
        $alias_1 = "trojan.spy.suixin" ascii wide nocase
        $alias_2 = "spyware.suixin" ascii wide nocase
        $alias_3 = "win32/suixin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SUIXIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Suixin tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/suixin"
        date = "2026-10-16"
    strings:
        $attrib_str = "suixin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Suloc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/suloc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SULOC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Suloc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/suloc"
        date = "2026-10-16"
    strings:
        $fam_name = "suloc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SULOC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Suloc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/suloc"
        date = "2026-10-16"
    strings:
        $attrib_str = "suloc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sunnydigits (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sunnydigits
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SUNNYDIGITS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sunnydigits (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sunnydigits"
        date = "2026-10-16"
    strings:
        $fam_name = "sunnydigits" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SUNNYDIGITS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sunnydigits tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sunnydigits"
        date = "2026-10-16"
    strings:
        $attrib_str = "sunnydigits" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Superspy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/superspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SUPERSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Superspy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/superspy"
        date = "2026-10-16"
    strings:
        $fam_name = "superspy" ascii wide nocase
        $alias_1 = "spyware.superspy" ascii wide nocase
        $alias_2 = "keylogger.superspy" ascii wide nocase
        $alias_3 = "monitor.win32.superspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SUPERSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Superspy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/superspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "superspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Superthreat (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/superthreat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SUPERTHREAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Superthreat (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/superthreat"
        date = "2026-10-16"
    strings:
        $fam_name = "superthreat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SUPERTHREAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Superthreat tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/superthreat"
        date = "2026-10-16"
    strings:
        $attrib_str = "superthreat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Surveyer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/surveyer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SURVEYER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Surveyer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/surveyer"
        date = "2026-10-16"
    strings:
        $fam_name = "surveyer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SURVEYER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Surveyer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/surveyer"
        date = "2026-10-16"
    strings:
        $attrib_str = "surveyer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Suviapen (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/suviapen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SUVIAPEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Suviapen (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/suviapen"
        date = "2026-10-16"
    strings:
        $fam_name = "suviapen" ascii wide nocase
        $alias_1 = "trojan.suviapen" ascii wide nocase
        $alias_2 = "downloader.suviapen" ascii wide nocase
        $alias_3 = "win32/suviapen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SUVIAPEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Suviapen tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/suviapen"
        date = "2026-10-16"
    strings:
        $attrib_str = "suviapen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Swisyn (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/swisyn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SWISYN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Swisyn (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swisyn"
        date = "2026-10-16"
    strings:
        $fam_name = "swisyn" ascii wide nocase
        $alias_1 = "swisyn" ascii wide nocase
        $alias_2 = "trojan:win32/swisyn" ascii wide nocase
        $alias_3 = "trojandropper:win32/swisyn" ascii wide nocase
        $alias_4 = "trojan.win32.swisyn" ascii wide nocase
        $alias_5 = "win32/swisyn" ascii wide nocase
        $alias_6 = "trojan.swisyn" ascii wide nocase
        $alias_7 = "swisyn dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SWISYN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Swisyn tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swisyn"
        date = "2026-10-16"
    strings:
        $attrib_str = "swisyn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Swizzor (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/swizzor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SWIZZOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Swizzor (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swizzor"
        date = "2026-10-16"
    strings:
        $fam_name = "swizzor" ascii wide nocase
        $alias_1 = "adware:win32/swizzor" ascii wide nocase
        $alias_2 = "trojan.win32.swizzor" ascii wide nocase
        $alias_3 = "win32/swizzor" ascii wide nocase
        $alias_4 = "swizzor adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SWIZZOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Swizzor tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swizzor"
        date = "2026-10-16"
    strings:
        $attrib_str = "swizzor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Swog (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/swog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SWOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Swog (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swog"
        date = "2026-10-16"
    strings:
        $fam_name = "swog" ascii wide nocase
        $alias_1 = "trojan.swog" ascii wide nocase
        $alias_2 = "downloader.swog" ascii wide nocase
        $alias_3 = "win32/swog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SWOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Swog tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swog"
        date = "2026-10-16"
    strings:
        $attrib_str = "swog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Swotter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/swotter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SWOTTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Swotter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swotter"
        date = "2026-10-16"
    strings:
        $fam_name = "swotter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SWOTTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Swotter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swotter"
        date = "2026-10-16"
    strings:
        $attrib_str = "swotter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Swpatch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/swpatch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SWPATCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Swpatch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swpatch"
        date = "2026-10-16"
    strings:
        $fam_name = "swpatch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SWPATCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Swpatch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swpatch"
        date = "2026-10-16"
    strings:
        $attrib_str = "swpatch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Swrort (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/swrort
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SWRORT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Swrort (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swrort"
        date = "2026-10-16"
    strings:
        $fam_name = "swrort" ascii wide nocase
        $alias_1 = "backdoor:win32/swrort.a" ascii wide nocase
        $alias_2 = "bkdr_swrort.a" ascii wide nocase
        $alias_3 = "trojan:win32/swrort" ascii wide nocase
        $alias_4 = "trojan.swrort" ascii wide nocase
        $alias_5 = "win32/swrort" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SWRORT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Swrort tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/swrort"
        date = "2026-10-16"
    strings:
        $attrib_str = "swrort" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Syncopate (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/syncopate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYNCOPATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Syncopate (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/syncopate"
        date = "2026-10-16"
    strings:
        $fam_name = "syncopate" ascii wide nocase
        $alias_1 = "adware.syncopate" ascii wide nocase
        $alias_2 = "pup.syncopate" ascii wide nocase
        $alias_3 = "browsermodifier:win32/syncopate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYNCOPATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Syncopate tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/syncopate"
        date = "2026-10-16"
    strings:
        $attrib_str = "syncopate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Synrat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/synrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYNRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Synrat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/synrat"
        date = "2026-10-16"
    strings:
        $fam_name = "synrat" ascii wide nocase
        $alias_1 = "syn-rat" ascii wide nocase
        $alias_2 = "backdoor.synrat" ascii wide nocase
        $alias_3 = "synrat by darkcodersc" ascii wide nocase
        $alias_4 = "darkcomet precursor" ascii wide nocase
        $alias_5 = "trojan.synrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYNRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Synrat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/synrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "synrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Syscon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/syscon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSCON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Syscon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/syscon"
        date = "2026-10-16"
    strings:
        $fam_name = "syscon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSCON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Syscon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/syscon"
        date = "2026-10-16"
    strings:
        $attrib_str = "syscon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sysdrop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sysdrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSDROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sysdrop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sysdrop"
        date = "2026-10-16"
    strings:
        $fam_name = "sysdrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSDROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sysdrop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sysdrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "sysdrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sysn (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sysn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sysn (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sysn"
        date = "2026-10-16"
    strings:
        $fam_name = "sysn" ascii wide nocase
        $alias_1 = "trojan:win32/sysn" ascii wide nocase
        $alias_2 = "trojan.win32.sysn" ascii wide nocase
        $alias_3 = "trojan.win32.sysna" ascii wide nocase
        $alias_4 = "swisyn" ascii wide nocase
        $alias_5 = "win32/sysn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sysn tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sysn"
        date = "2026-10-16"
    strings:
        $attrib_str = "sysn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Systemcare (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/systemcare
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSTEMCARE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Systemcare (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systemcare"
        date = "2026-10-16"
    strings:
        $fam_name = "systemcare" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSTEMCARE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Systemcare tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systemcare"
        date = "2026-10-16"
    strings:
        $attrib_str = "systemcare" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Systemhealer (Rogue)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/systemhealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSTEMHEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Systemhealer (Rogue)"
        category = "Rogue"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systemhealer"
        date = "2026-10-16"
    strings:
        $fam_name = "systemhealer" ascii wide nocase
        $alias_1 = "pua:win32/systemhealer" ascii wide nocase
        $alias_2 = "program:win32/systemhealer" ascii wide nocase
        $alias_3 = "rogue:win32/systemhealer" ascii wide nocase
        $alias_4 = "win32/systemhealer" ascii wide nocase
        $alias_5 = "pua.systemhealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSTEMHEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Systemhealer tradecraft"
        category = "Rogue"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systemhealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "systemhealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Systemhijack (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/systemhijack
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSTEMHIJACK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Systemhijack (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systemhijack"
        date = "2026-10-16"
    strings:
        $fam_name = "systemhijack" ascii wide nocase
        $alias_1 = "trojan.systemhijack" ascii wide nocase
        $alias_2 = "win32/systemhijack" ascii wide nocase
        $alias_3 = "systemmodifier" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSTEMHIJACK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Systemhijack tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systemhijack"
        date = "2026-10-16"
    strings:
        $attrib_str = "systemhijack" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Systex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/systex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSTEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Systex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systex"
        date = "2026-10-16"
    strings:
        $fam_name = "systex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSTEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Systex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systex"
        date = "2026-10-16"
    strings:
        $attrib_str = "systex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Systimizer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/systimizer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSTIMIZER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Systimizer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systimizer"
        date = "2026-10-16"
    strings:
        $fam_name = "systimizer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSTIMIZER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Systimizer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systimizer"
        date = "2026-10-16"
    strings:
        $attrib_str = "systimizer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Systweak (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/systweak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSTWEAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Systweak (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systweak"
        date = "2026-10-16"
    strings:
        $fam_name = "systweak" ascii wide nocase
        $alias_1 = "pua:win32/systweak" ascii wide nocase
        $alias_2 = "rogue:win32/systweak" ascii wide nocase
        $alias_3 = "adware:win32/systweak" ascii wide nocase
        $alias_4 = "pup.optional.systweak" ascii wide nocase
        $alias_5 = "program:win32/systweak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSTWEAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Systweak tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systweak"
        date = "2026-10-16"
    strings:
        $attrib_str = "systweak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Systweaker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/systweaker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSTWEAKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Systweaker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systweaker"
        date = "2026-10-16"
    strings:
        $fam_name = "systweaker" ascii wide nocase
        $alias_1 = "rogue.systweaker" ascii wide nocase
        $alias_2 = "pup.systweaker" ascii wide nocase
        $alias_3 = "fakeoptimizer.systweaker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSTWEAKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Systweaker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/systweaker"
        date = "2026-10-16"
    strings:
        $attrib_str = "systweaker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sysupdate (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sysupdate
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYSUPDATE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sysupdate (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sysupdate"
        date = "2026-10-16"
    strings:
        $fam_name = "sysupdate" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYSUPDATE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sysupdate tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sysupdate"
        date = "2026-10-16"
    strings:
        $attrib_str = "sysupdate" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Sytro (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sytro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SYTRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sytro (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sytro"
        date = "2026-10-16"
    strings:
        $fam_name = "sytro" ascii wide nocase
        $alias_1 = "worm:win32/sytro" ascii wide nocase
        $alias_2 = "p2p-worm.win32.sytro" ascii wide nocase
        $alias_3 = "trojan:win32/sytro" ascii wide nocase
        $alias_4 = "win32/sytro.a" ascii wide nocase
        $alias_5 = "worm.sytro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SYTRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sytro tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sytro"
        date = "2026-10-16"
    strings:
        $attrib_str = "sytro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sz4Aaw (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sz4aaw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SZ4AAW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sz4Aaw (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sz4aaw"
        date = "2026-10-16"
    strings:
        $fam_name = "sz4aaw" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.sz4aaw" ascii wide nocase
        $alias_3 = "heur.sz4aaw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SZ4AAW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sz4Aaw tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sz4aaw"
        date = "2026-10-16"
    strings:
        $attrib_str = "sz4aaw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Taily (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/taily
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TAILY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Taily (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taily"
        date = "2026-10-16"
    strings:
        $fam_name = "taily" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TAILY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Taily tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taily"
        date = "2026-10-16"
    strings:
        $attrib_str = "taily" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tainp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tainp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TAINP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tainp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tainp"
        date = "2026-10-16"
    strings:
        $fam_name = "tainp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TAINP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tainp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tainp"
        date = "2026-10-16"
    strings:
        $attrib_str = "tainp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Takbum (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/takbum
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TAKBUM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Takbum (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/takbum"
        date = "2026-10-16"
    strings:
        $fam_name = "takbum" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TAKBUM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Takbum tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/takbum"
        date = "2026-10-16"
    strings:
        $attrib_str = "takbum" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Talalpek (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/talalpek
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TALALPEK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Talalpek (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/talalpek"
        date = "2026-10-16"
    strings:
        $fam_name = "talalpek" ascii wide nocase
        $alias_1 = "adware.talalpek" ascii wide nocase
        $alias_2 = "pup.talalpek" ascii wide nocase
        $alias_3 = "browsermodifier.talalpek" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TALALPEK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Talalpek tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/talalpek"
        date = "2026-10-16"
    strings:
        $attrib_str = "talalpek" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Talent (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/talent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TALENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Talent (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/talent"
        date = "2026-10-16"
    strings:
        $fam_name = "talent" ascii wide nocase
        $alias_1 = "ransom:win32/talent" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.talent" ascii wide nocase
        $alias_3 = "win32/talent" ascii wide nocase
        $alias_4 = "talent ransomware" ascii wide nocase
        $alias_5 = "ransom.talent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TALENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Talent tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/talent"
        date = "2026-10-16"
    strings:
        $attrib_str = "talent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Talmad (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/talmad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TALMAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Talmad (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/talmad"
        date = "2026-10-16"
    strings:
        $fam_name = "talmad" ascii wide nocase
        $alias_1 = "trojan.talmad" ascii wide nocase
        $alias_2 = "downloader.talmad" ascii wide nocase
        $alias_3 = "win32/talmad" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TALMAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Talmad tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/talmad"
        date = "2026-10-16"
    strings:
        $attrib_str = "talmad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tanske (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tanske
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TANSKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tanske (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tanske"
        date = "2026-10-16"
    strings:
        $fam_name = "tanske" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TANSKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tanske tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tanske"
        date = "2026-10-16"
    strings:
        $attrib_str = "tanske" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tanspy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tanspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TANSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tanspy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tanspy"
        date = "2026-10-16"
    strings:
        $fam_name = "tanspy" ascii wide nocase
        $alias_1 = "trojan.tanspy" ascii wide nocase
        $alias_2 = "spyware.tanspy" ascii wide nocase
        $alias_3 = "win32/spy.tanspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TANSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tanspy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tanspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "tanspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Taobao (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/taobao
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TAOBAO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Taobao (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taobao"
        date = "2026-10-16"
    strings:
        $fam_name = "taobao" ascii wide nocase
        $alias_1 = "adware.taobao" ascii wide nocase
        $alias_2 = "pup.taobao" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TAOBAO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Taobao tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taobao"
        date = "2026-10-16"
    strings:
        $attrib_str = "taobao" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Taojinstar (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/taojinstar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TAOJINSTAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Taojinstar (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taojinstar"
        date = "2026-10-16"
    strings:
        $fam_name = "taojinstar" ascii wide nocase
        $alias_1 = "adware.taojinstar" ascii wide nocase
        $alias_2 = "pup.taojinstar" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TAOJINSTAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Taojinstar tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taojinstar"
        date = "2026-10-16"
    strings:
        $attrib_str = "taojinstar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Taptrap (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/taptrap
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TAPTRAP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Taptrap (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taptrap"
        date = "2026-10-16"
    strings:
        $fam_name = "taptrap" ascii wide nocase
        $alias_1 = "androidos.taptrap" ascii wide nocase
        $alias_2 = "trojan.android.taptrap" ascii wide nocase
        $alias_3 = "spyware.taptrap" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TAPTRAP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Taptrap tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taptrap"
        date = "2026-10-16"
    strings:
        $attrib_str = "taptrap" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Tar4Rkdi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tar4rkdi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TAR4RKDI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tar4Rkdi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tar4rkdi"
        date = "2026-10-16"
    strings:
        $fam_name = "tar4rkdi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TAR4RKDI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tar4Rkdi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tar4rkdi"
        date = "2026-10-16"
    strings:
        $attrib_str = "tar4rkdi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Taranis (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/taranis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TARANIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Taranis (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taranis"
        date = "2026-10-16"
    strings:
        $fam_name = "taranis" ascii wide nocase
        $alias_1 = "trojan:win32/taranis" ascii wide nocase
        $alias_2 = "tr/taranis" ascii wide nocase
        $alias_3 = "win32/taranis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TARANIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Taranis tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taranis"
        date = "2026-10-16"
    strings:
        $attrib_str = "taranis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Tarayt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tarayt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TARAYT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tarayt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tarayt"
        date = "2026-10-16"
    strings:
        $fam_name = "tarayt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TARAYT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tarayt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tarayt"
        date = "2026-10-16"
    strings:
        $attrib_str = "tarayt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tarctox (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tarctox
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TARCTOX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tarctox (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tarctox"
        date = "2026-10-16"
    strings:
        $fam_name = "tarctox" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TARCTOX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tarctox tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tarctox"
        date = "2026-10-16"
    strings:
        $attrib_str = "tarctox" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tarifarch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tarifarch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TARIFARCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tarifarch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tarifarch"
        date = "2026-10-16"
    strings:
        $fam_name = "tarifarch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TARIFARCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tarifarch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tarifarch"
        date = "2026-10-16"
    strings:
        $attrib_str = "tarifarch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tartober (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tartober
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TARTOBER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tartober (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tartober"
        date = "2026-10-16"
    strings:
        $fam_name = "tartober" ascii wide nocase
        $alias_1 = "trojan.tartober" ascii wide nocase
        $alias_2 = "downloader.tartober" ascii wide nocase
        $alias_3 = "win32/tartober" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TARTOBER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tartober tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tartober"
        date = "2026-10-16"
    strings:
        $attrib_str = "tartober" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tasker (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tasker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TASKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tasker (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tasker"
        date = "2026-10-16"
    strings:
        $fam_name = "tasker" ascii wide nocase
        $alias_1 = "trojan:win32/tasker" ascii wide nocase
        $alias_2 = "backdoor:win32/tasker" ascii wide nocase
        $alias_3 = "trojan.tasker" ascii wide nocase
        $alias_4 = "win32/tasker" ascii wide nocase
        $alias_5 = "trojan:win32/tasker.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TASKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tasker tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tasker"
        date = "2026-10-16"
    strings:
        $attrib_str = "tasker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Taskkill (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/taskkill
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TASKKILL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Taskkill (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taskkill"
        date = "2026-10-16"
    strings:
        $fam_name = "taskkill" ascii wide nocase
        $alias_1 = "tool.taskkill.abuse" ascii wide nocase
        $alias_2 = "lolbin.taskkill" ascii wide nocase
        $alias_3 = "suspicious.commandexecution" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TASKKILL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Taskkill tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taskkill"
        date = "2026-10-16"
    strings:
        $attrib_str = "taskkill" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Taterf (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/taterf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TATERF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Taterf (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taterf"
        date = "2026-10-16"
    strings:
        $fam_name = "taterf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TATERF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Taterf tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taterf"
        date = "2026-10-16"
    strings:
        $attrib_str = "taterf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Taworm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/taworm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TAWORM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Taworm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taworm"
        date = "2026-10-16"
    strings:
        $fam_name = "taworm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TAWORM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Taworm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/taworm"
        date = "2026-10-16"
    strings:
        $attrib_str = "taworm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tbma (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tbma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TBMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tbma (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tbma"
        date = "2026-10-16"
    strings:
        $fam_name = "tbma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TBMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tbma tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tbma"
        date = "2026-10-16"
    strings:
        $attrib_str = "tbma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tcdrop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tcdrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TCDROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tcdrop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tcdrop"
        date = "2026-10-16"
    strings:
        $fam_name = "tcdrop" ascii wide nocase
        $alias_1 = "trojan.tcdrop" ascii wide nocase
        $alias_2 = "dropper.tcdrop" ascii wide nocase
        $alias_3 = "win32/tcdrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TCDROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tcdrop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tcdrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "tcdrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tdss (Rootkit)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tdss
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TDSS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tdss (Rootkit)"
        category = "Rootkit"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tdss"
        date = "2026-10-16"
    strings:
        $fam_name = "tdss" ascii wide nocase
        $alias_1 = "rootkit:win32/tdss" ascii wide nocase
        $alias_2 = "trojan:win32/alureon" ascii wide nocase
        $alias_3 = "rootkit.win32.tdss.tdl4" ascii wide nocase
        $alias_4 = "w32.tidserv" ascii wide nocase
        $alias_5 = "tdl-4 rootkit" ascii wide nocase
        $alias_6 = "backdoor.win32.tdss" ascii wide nocase
        $alias_7 = "alureon bootkit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TDSS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tdss tradecraft"
        category = "Rootkit"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tdss"
        date = "2026-10-16"
    strings:
        $attrib_str = "tdss" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Teambot (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/teambot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TEAMBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Teambot (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/teambot"
        date = "2026-10-16"
    strings:
        $fam_name = "teambot" ascii wide nocase
        $alias_1 = "trojan.teambot" ascii wide nocase
        $alias_2 = "downloader.teambot" ascii wide nocase
        $alias_3 = "win32/teambot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TEAMBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Teambot tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/teambot"
        date = "2026-10-16"
    strings:
        $attrib_str = "teambot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Teamspy (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/teamspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TEAMSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Teamspy (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/teamspy"
        date = "2026-10-16"
    strings:
        $fam_name = "teamspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TEAMSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Teamspy tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/teamspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "teamspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Teamviewer (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/teamviewer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TEAMVIEWER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Teamviewer (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/teamviewer"
        date = "2026-10-16"
    strings:
        $fam_name = "teamviewer" ascii wide nocase
        $alias_1 = "riskware.teamviewer" ascii wide nocase
        $alias_2 = "tool.teamviewer" ascii wide nocase
        $alias_3 = "remoteaccess.teamviewer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TEAMVIEWER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Teamviewer tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/teamviewer"
        date = "2026-10-16"
    strings:
        $attrib_str = "teamviewer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Tear (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tear
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TEAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tear (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tear"
        date = "2026-10-16"
    strings:
        $fam_name = "tear" ascii wide nocase
        $alias_1 = "backdoor.tear" ascii wide nocase
        $alias_2 = "rat.tear" ascii wide nocase
        $alias_3 = "win32/tear" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TEAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tear tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tear"
        date = "2026-10-16"
    strings:
        $attrib_str = "tear" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Techsnab (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/techsnab
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TECHSNAB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Techsnab (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/techsnab"
        date = "2026-10-16"
    strings:
        $fam_name = "techsnab" ascii wide nocase
        $alias_1 = "softwarebundler:win32/techsnab" ascii wide nocase
        $alias_2 = "trojan:win32/techsnab" ascii wide nocase
        $alias_3 = "pua:win32/techsnab" ascii wide nocase
        $alias_4 = "win32/techsnab" ascii wide nocase
        $alias_5 = "adware.techsnab" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TECHSNAB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Techsnab tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/techsnab"
        date = "2026-10-16"
    strings:
        $attrib_str = "techsnab" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tedroo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tedroo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TEDROO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tedroo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tedroo"
        date = "2026-10-16"
    strings:
        $fam_name = "tedroo" ascii wide nocase
        $alias_1 = "trojan.tedroo" ascii wide nocase
        $alias_2 = "downloader.tedroo" ascii wide nocase
        $alias_3 = "win32/tedroo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TEDROO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tedroo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tedroo"
        date = "2026-10-16"
    strings:
        $attrib_str = "tedroo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Temcac (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/temcac
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TEMCAC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Temcac (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/temcac"
        date = "2026-10-16"
    strings:
        $fam_name = "temcac" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TEMCAC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Temcac tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/temcac"
        date = "2026-10-16"
    strings:
        $attrib_str = "temcac" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Temonde (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/temonde
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TEMONDE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Temonde (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/temonde"
        date = "2026-10-16"
    strings:
        $fam_name = "temonde" ascii wide nocase
        $alias_1 = "adware.temonde" ascii wide nocase
        $alias_2 = "win.dropper.temonde" ascii wide nocase
        $alias_3 = "trojan:win32/temonde" ascii wide nocase
        $alias_4 = "adware:win32/temonde" ascii wide nocase
        $alias_5 = "win32/temonde" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TEMONDE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Temonde tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/temonde"
        date = "2026-10-16"
    strings:
        $attrib_str = "temonde" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tempedreve (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tempedreve
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TEMPEDREVE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tempedreve (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tempedreve"
        date = "2026-10-16"
    strings:
        $fam_name = "tempedreve" ascii wide nocase
        $alias_1 = "trojandownloader:win32/tempedreve" ascii wide nocase
        $alias_2 = "trojan:win32/tempedreve" ascii wide nocase
        $alias_3 = "win32/tempedreve" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TEMPEDREVE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tempedreve tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tempedreve"
        date = "2026-10-16"
    strings:
        $attrib_str = "tempedreve" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Temr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/temr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TEMR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Temr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/temr"
        date = "2026-10-16"
    strings:
        $fam_name = "temr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TEMR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Temr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/temr"
        date = "2026-10-16"
    strings:
        $attrib_str = "temr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tenavt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tenavt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TENAVT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tenavt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tenavt"
        date = "2026-10-16"
    strings:
        $fam_name = "tenavt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TENAVT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tenavt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tenavt"
        date = "2026-10-16"
    strings:
        $attrib_str = "tenavt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tencent (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tencent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TENCENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tencent (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tencent"
        date = "2026-10-16"
    strings:
        $fam_name = "tencent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TENCENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tencent tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tencent"
        date = "2026-10-16"
    strings:
        $attrib_str = "tencent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tenga (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tenga
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TENGA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tenga (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tenga"
        date = "2026-10-16"
    strings:
        $fam_name = "tenga" ascii wide nocase
        $alias_1 = "virus:win32/tenga" ascii wide nocase
        $alias_2 = "win32/tenga.a" ascii wide nocase
        $alias_3 = "virus.win32.gat.a" ascii wide nocase
        $alias_4 = "w32.gat" ascii wide nocase
        $alias_5 = "win32/tenga" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TENGA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tenga tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tenga"
        date = "2026-10-16"
    strings:
        $attrib_str = "tenga" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Terabit_Virus_Maker (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/terabit_virus_maker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TERABIT_VIRUS_MAKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Terabit_Virus_Maker (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/terabit_virus_maker"
        date = "2026-10-16"
    strings:
        $fam_name = "terabit_virus_maker" ascii wide nocase
        $alias_1 = "tvm" ascii wide nocase
        $alias_2 = "terabit virus maker by m_reza00" ascii wide nocase
        $alias_3 = "hacktool.win32.terabit" ascii wide nocase
        $alias_4 = "terabit trojan generator" ascii wide nocase
        $alias_5 = "terabit 2.8" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TERABIT_VIRUS_MAKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Terabit_Virus_Maker tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/terabit_virus_maker"
        date = "2026-10-16"
    strings:
        $attrib_str = "terabit_virus_maker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Teramind (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/teramind
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TERAMIND_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Teramind (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/teramind"
        date = "2026-10-16"
    strings:
        $fam_name = "teramind" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TERAMIND_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Teramind tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/teramind"
        date = "2026-10-16"
    strings:
        $attrib_str = "teramind" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Terkcop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/terkcop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TERKCOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Terkcop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/terkcop"
        date = "2026-10-16"
    strings:
        $fam_name = "terkcop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TERKCOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Terkcop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/terkcop"
        date = "2026-10-16"
    strings:
        $attrib_str = "terkcop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Termite (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/termite
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TERMITE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Termite (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/termite"
        date = "2026-10-16"
    strings:
        $fam_name = "termite" ascii wide nocase
        $alias_1 = "rat.termite" ascii wide nocase
        $alias_2 = "backdoor.netweaver" ascii wide nocase
        $alias_3 = "hacktool.termite" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TERMITE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Termite tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/termite"
        date = "2026-10-16"
    strings:
        $attrib_str = "termite" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Tescrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tescrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TESCRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tescrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tescrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "tescrypt" ascii wide nocase
        $alias_1 = "ransom:win32/tescrypt" ascii wide nocase
        $alias_2 = "teslacrypt" ascii wide nocase
        $alias_3 = "trojan-ransom.win32.teslacrypt" ascii wide nocase
        $alias_4 = "ransom.teslacrypt" ascii wide nocase
        $alias_5 = "win32/teslacrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TESCRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tescrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tescrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "tescrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Teslacrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/teslacrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TESLACRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Teslacrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/teslacrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "teslacrypt" ascii wide nocase
        $alias_1 = "teslacrypt" ascii wide nocase
        $alias_2 = "trojan.teslacrypt" ascii wide nocase
        $alias_3 = "win32/teslacrypt" ascii wide nocase
        $alias_4 = "ransom.teslacrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TESLACRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Teslacrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/teslacrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "teslacrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Testfile (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/testfile
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TESTFILE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Testfile (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/testfile"
        date = "2026-10-16"
    strings:
        $fam_name = "testfile" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TESTFILE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Testfile tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/testfile"
        date = "2026-10-16"
    strings:
        $attrib_str = "testfile" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tftpd (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tftpd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TFTPD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tftpd (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tftpd"
        date = "2026-10-16"
    strings:
        $fam_name = "tftpd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TFTPD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tftpd tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tftpd"
        date = "2026-10-16"
    strings:
        $attrib_str = "tftpd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tgrandongc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tgrandongc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TGRANDONGC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tgrandongc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tgrandongc"
        date = "2026-10-16"
    strings:
        $fam_name = "tgrandongc" ascii wide nocase
        $alias_1 = "trojan.tgrandongc" ascii wide nocase
        $alias_2 = "downloader.tgrandongc" ascii wide nocase
        $alias_3 = "win32/tgrandongc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TGRANDONGC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tgrandongc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tgrandongc"
        date = "2026-10-16"
    strings:
        $attrib_str = "tgrandongc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Thanatos (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/thanatos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_THANATOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Thanatos (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/thanatos"
        date = "2026-10-16"
    strings:
        $fam_name = "thanatos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_THANATOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Thanatos tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/thanatos"
        date = "2026-10-16"
    strings:
        $attrib_str = "thanatos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Therat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/therat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_THERAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Therat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/therat"
        date = "2026-10-16"
    strings:
        $fam_name = "therat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_THERAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Therat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/therat"
        date = "2026-10-16"
    strings:
        $attrib_str = "therat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Thoper (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/thoper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_THOPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Thoper (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/thoper"
        date = "2026-10-16"
    strings:
        $fam_name = "thoper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_THOPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Thoper tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/thoper"
        date = "2026-10-16"
    strings:
        $attrib_str = "thoper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tibia (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tibia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIBIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tibia (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tibia"
        date = "2026-10-16"
    strings:
        $fam_name = "tibia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIBIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tibia tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tibia"
        date = "2026-10-16"
    strings:
        $attrib_str = "tibia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tibs (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tibs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIBS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tibs (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tibs"
        date = "2026-10-16"
    strings:
        $fam_name = "tibs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIBS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tibs tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tibs"
        date = "2026-10-16"
    strings:
        $attrib_str = "tibs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Tibsystems (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tibsystems
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIBSYSTEMS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tibsystems (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tibsystems"
        date = "2026-10-16"
    strings:
        $fam_name = "tibsystems" ascii wide nocase
        $alias_1 = "adware.tibsystems" ascii wide nocase
        $alias_2 = "pup.tibsystems" ascii wide nocase
        $alias_3 = "browsermodifier:win32/tibsystems" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIBSYSTEMS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tibsystems tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tibsystems"
        date = "2026-10-16"
    strings:
        $attrib_str = "tibsystems" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tick (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tick
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TICK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tick (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tick"
        date = "2026-10-16"
    strings:
        $fam_name = "tick" ascii wide nocase
        $alias_1 = "apt.tick" ascii wide nocase
        $alias_2 = "bronze butler" ascii wide nocase
        $alias_3 = "redbaldknight" ascii wide nocase
        $alias_4 = "stalker panda" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TICK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tick tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tick"
        date = "2026-10-16"
    strings:
        $attrib_str = "tick" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Tierry (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tierry
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIERRY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tierry (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tierry"
        date = "2026-10-16"
    strings:
        $fam_name = "tierry" ascii wide nocase
        $alias_1 = "trojan.tierry" ascii wide nocase
        $alias_2 = "downloader.tierry" ascii wide nocase
        $alias_3 = "win32/tierry" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIERRY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tierry tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tierry"
        date = "2026-10-16"
    strings:
        $attrib_str = "tierry" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tiggre (Cryptominer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tiggre
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIGGRE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tiggre (Cryptominer)"
        category = "Cryptominer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tiggre"
        date = "2026-10-16"
    strings:
        $fam_name = "tiggre" ascii wide nocase
        $alias_1 = "tiggre" ascii wide nocase
        $alias_2 = "trojan:win32/tiggre!rfn" ascii wide nocase
        $alias_3 = "coinminer.tiggre" ascii wide nocase
        $alias_4 = "trojan.tiggre" ascii wide nocase
        $alias_5 = "win32/tiggre" ascii wide nocase
        $alias_6 = "tiggre miner" ascii wide nocase
        $alias_7 = "trojan:win32/tiggre" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIGGRE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tiggre tradecraft"
        category = "Cryptominer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tiggre"
        date = "2026-10-16"
    strings:
        $attrib_str = "tiggre" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tiklog (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tiklog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIKLOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tiklog (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tiklog"
        date = "2026-10-16"
    strings:
        $fam_name = "tiklog" ascii wide nocase
        $alias_1 = "trojan.keylogger.tiklog" ascii wide nocase
        $alias_2 = "spyware.tiklog" ascii wide nocase
        $alias_3 = "win32/tiklog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIKLOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tiklog tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tiklog"
        date = "2026-10-16"
    strings:
        $attrib_str = "tiklog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tikoog (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tikoog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIKOOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tikoog (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tikoog"
        date = "2026-10-16"
    strings:
        $fam_name = "tikoog" ascii wide nocase
        $alias_1 = "trojan.tikoog" ascii wide nocase
        $alias_2 = "downloader.tikoog" ascii wide nocase
        $alias_3 = "win32/tikoog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIKOOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tikoog tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tikoog"
        date = "2026-10-16"
    strings:
        $attrib_str = "tikoog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tilken (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tilken
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TILKEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tilken (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tilken"
        date = "2026-10-16"
    strings:
        $fam_name = "tilken" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TILKEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tilken tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tilken"
        date = "2026-10-16"
    strings:
        $attrib_str = "tilken" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Timesink (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/timesink
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIMESINK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Timesink (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/timesink"
        date = "2026-10-16"
    strings:
        $fam_name = "timesink" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIMESINK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Timesink tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/timesink"
        date = "2026-10-16"
    strings:
        $attrib_str = "timesink" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tinba (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tinba
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TINBA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tinba (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinba"
        date = "2026-10-16"
    strings:
        $fam_name = "tinba" ascii wide nocase
        $alias_1 = "tinba" ascii wide nocase
        $alias_2 = "tiny banker" ascii wide nocase
        $alias_3 = "zusy" ascii wide nocase
        $alias_4 = "trojan:win32/tinba" ascii wide nocase
        $alias_5 = "win32/tinba" ascii wide nocase
        $alias_6 = "tiny banker trojan" ascii wide nocase
        $alias_7 = "trojan.tinba" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TINBA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tinba tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinba"
        date = "2026-10-16"
    strings:
        $attrib_str = "tinba" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Tinclex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tinclex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TINCLEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tinclex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinclex"
        date = "2026-10-16"
    strings:
        $fam_name = "tinclex" ascii wide nocase
        $alias_1 = "trojan.tinclex" ascii wide nocase
        $alias_2 = "downloader.tinclex" ascii wide nocase
        $alias_3 = "win32/tinclex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TINCLEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tinclex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinclex"
        date = "2026-10-16"
    strings:
        $attrib_str = "tinclex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tinukebot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tinukebot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TINUKEBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tinukebot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinukebot"
        date = "2026-10-16"
    strings:
        $fam_name = "tinukebot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TINUKEBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tinukebot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinukebot"
        date = "2026-10-16"
    strings:
        $attrib_str = "tinukebot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Tinydl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tinydl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TINYDL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tinydl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinydl"
        date = "2026-10-16"
    strings:
        $fam_name = "tinydl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TINYDL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tinydl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinydl"
        date = "2026-10-16"
    strings:
        $attrib_str = "tinydl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tinyloader (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tinyloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TINYLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tinyloader (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinyloader"
        date = "2026-10-16"
    strings:
        $fam_name = "tinyloader" ascii wide nocase
        $alias_1 = "trojandownloader:win32/tinyloader" ascii wide nocase
        $alias_2 = "trojan.tinyloader" ascii wide nocase
        $alias_3 = "downloader.tinyloader" ascii wide nocase
        $alias_4 = "win32/tinyloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TINYLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tinyloader tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinyloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "tinyloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tinynuke (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tinynuke
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TINYNUKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tinynuke (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinynuke"
        date = "2026-10-16"
    strings:
        $fam_name = "tinynuke" ascii wide nocase
        $alias_1 = "trojan:win32/tinynuke" ascii wide nocase
        $alias_2 = "trojan.nukebot" ascii wide nocase
        $alias_3 = "backdoor:win32/tinynuke" ascii wide nocase
        $alias_4 = "win32/nukebot" ascii wide nocase
        $alias_5 = "tinynuke banking trojan" ascii wide nocase
        $alias_6 = "nukebot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TINYNUKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tinynuke tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinynuke"
        date = "2026-10-16"
    strings:
        $attrib_str = "tinynuke" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Tinypos (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tinypos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TINYPOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tinypos (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinypos"
        date = "2026-10-16"
    strings:
        $fam_name = "tinypos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TINYPOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tinypos tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tinypos"
        date = "2026-10-16"
    strings:
        $attrib_str = "tinypos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tipp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tipp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIPP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tipp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tipp"
        date = "2026-10-16"
    strings:
        $fam_name = "tipp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIPP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tipp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tipp"
        date = "2026-10-16"
    strings:
        $attrib_str = "tipp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tirrip (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tirrip
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIRRIP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tirrip (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tirrip"
        date = "2026-10-16"
    strings:
        $fam_name = "tirrip" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIRRIP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tirrip tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tirrip"
        date = "2026-10-16"
    strings:
        $attrib_str = "tirrip" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Titirez (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/titirez
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TITIREZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Titirez (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/titirez"
        date = "2026-10-16"
    strings:
        $fam_name = "titirez" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TITIREZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Titirez tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/titirez"
        date = "2026-10-16"
    strings:
        $attrib_str = "titirez" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tivmonk (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tivmonk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TIVMONK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tivmonk (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tivmonk"
        date = "2026-10-16"
    strings:
        $fam_name = "tivmonk" ascii wide nocase
        $alias_1 = "trojan.tivmonk" ascii wide nocase
        $alias_2 = "downloader.tivmonk" ascii wide nocase
        $alias_3 = "win32/tivmonk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TIVMONK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tivmonk tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tivmonk"
        date = "2026-10-16"
    strings:
        $attrib_str = "tivmonk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tmgfayxalbaj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tmgfayxalbaj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TMGFAYXALBAJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tmgfayxalbaj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tmgfayxalbaj"
        date = "2026-10-16"
    strings:
        $fam_name = "tmgfayxalbaj" ascii wide nocase
        $alias_1 = "trojan.obfuscated.gen" ascii wide nocase
        $alias_2 = "dropper.randomname" ascii wide nocase
        $alias_3 = "win32/trojan.packer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TMGFAYXALBAJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tmgfayxalbaj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tmgfayxalbaj"
        date = "2026-10-16"
    strings:
        $attrib_str = "tmgfayxalbaj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tnega (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tnega
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TNEGA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tnega (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tnega"
        date = "2026-10-16"
    strings:
        $fam_name = "tnega" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TNEGA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tnega tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tnega"
        date = "2026-10-16"
    strings:
        $attrib_str = "tnega" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Toauta (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/toauta
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOAUTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Toauta (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/toauta"
        date = "2026-10-16"
    strings:
        $fam_name = "toauta" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOAUTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Toauta tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/toauta"
        date = "2026-10-16"
    strings:
        $attrib_str = "toauta" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tobor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tobor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOBOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tobor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tobor"
        date = "2026-10-16"
    strings:
        $fam_name = "tobor" ascii wide nocase
        $alias_1 = "trojan.tobor" ascii wide nocase
        $alias_2 = "botnet.tobor" ascii wide nocase
        $alias_3 = "win32/tobor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOBOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tobor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tobor"
        date = "2026-10-16"
    strings:
        $attrib_str = "tobor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Tofsee (Spam_Bot)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tofsee
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOFSEE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tofsee (Spam_Bot)"
        category = "Spam_Bot"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tofsee"
        date = "2026-10-16"
    strings:
        $fam_name = "tofsee" ascii wide nocase
        $alias_1 = "gheg" ascii wide nocase
        $alias_2 = "backdoor.win32.tofsee" ascii wide nocase
        $alias_3 = "spambot.tofsee" ascii wide nocase
        $alias_4 = "win32/tofsee" ascii wide nocase
        $alias_5 = "tofsee botnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOFSEE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tofsee tradecraft"
        category = "Spam_Bot"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tofsee"
        date = "2026-10-16"
    strings:
        $attrib_str = "tofsee" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Toga (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/toga
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOGA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Toga (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/toga"
        date = "2026-10-16"
    strings:
        $fam_name = "toga" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOGA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Toga tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/toga"
        date = "2026-10-16"
    strings:
        $attrib_str = "toga" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Togapy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/togapy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOGAPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Togapy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/togapy"
        date = "2026-10-16"
    strings:
        $fam_name = "togapy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOGAPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Togapy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/togapy"
        date = "2026-10-16"
    strings:
        $attrib_str = "togapy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Toggle (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/toggle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOGGLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Toggle (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/toggle"
        date = "2026-10-16"
    strings:
        $fam_name = "toggle" ascii wide nocase
        $alias_1 = "browsermodifier:win32/toggle" ascii wide nocase
        $alias_2 = "adware:win32/toggle" ascii wide nocase
        $alias_3 = "pua:win32/toggle" ascii wide nocase
        $alias_4 = "toolbar:win32/toggle" ascii wide nocase
        $alias_5 = "win32/toggle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOGGLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Toggle tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/toggle"
        date = "2026-10-16"
    strings:
        $attrib_str = "toggle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tomegun (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tomegun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOMEGUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tomegun (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tomegun"
        date = "2026-10-16"
    strings:
        $fam_name = "tomegun" ascii wide nocase
        $alias_1 = "trojan.tomegun" ascii wide nocase
        $alias_2 = "downloader.tomegun" ascii wide nocase
        $alias_3 = "win32/tomegun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOMEGUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tomegun tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tomegun"
        date = "2026-10-16"
    strings:
        $attrib_str = "tomegun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tongji (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tongji
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TONGJI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tongji (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tongji"
        date = "2026-10-16"
    strings:
        $fam_name = "tongji" ascii wide nocase
        $alias_1 = "adware.tongji" ascii wide nocase
        $alias_2 = "spyware.tongji" ascii wide nocase
        $alias_3 = "pup.tongji" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TONGJI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tongji tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tongji"
        date = "2026-10-16"
    strings:
        $attrib_str = "tongji" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tonmye (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tonmye
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TONMYE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tonmye (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tonmye"
        date = "2026-10-16"
    strings:
        $fam_name = "tonmye" ascii wide nocase
        $alias_1 = "ransom:win32/tonmye" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.tonmye" ascii wide nocase
        $alias_3 = "win32/tonmye" ascii wide nocase
        $alias_4 = "ransom.tonmye" ascii wide nocase
        $alias_5 = "ransom:win32/tonmye.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TONMYE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tonmye tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tonmye"
        date = "2026-10-16"
    strings:
        $attrib_str = "tonmye" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Toptoo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/toptoo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOPTOO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Toptoo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/toptoo"
        date = "2026-10-16"
    strings:
        $fam_name = "toptoo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOPTOO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Toptoo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/toptoo"
        date = "2026-10-16"
    strings:
        $attrib_str = "toptoo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Toptools (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/toptools
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOPTOOLS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Toptools (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/toptools"
        date = "2026-10-16"
    strings:
        $fam_name = "toptools" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOPTOOLS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Toptools tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/toptools"
        date = "2026-10-16"
    strings:
        $attrib_str = "toptools" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tordev (Botnet)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tordev
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TORDEV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tordev (Botnet)"
        category = "Botnet"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tordev"
        date = "2026-10-16"
    strings:
        $fam_name = "tordev" ascii wide nocase
        $alias_1 = "trojan:win32/tordev" ascii wide nocase
        $alias_2 = "backdoor:win32/tordev" ascii wide nocase
        $alias_3 = "trojan.tordev" ascii wide nocase
        $alias_4 = "win32/tordev" ascii wide nocase
        $alias_5 = "tordev proxy botnet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TORDEV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tordev tradecraft"
        category = "Botnet"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tordev"
        date = "2026-10-16"
    strings:
        $attrib_str = "tordev" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Torjok (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/torjok
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TORJOK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Torjok (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/torjok"
        date = "2026-10-16"
    strings:
        $fam_name = "torjok" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TORJOK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Torjok tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/torjok"
        date = "2026-10-16"
    strings:
        $attrib_str = "torjok" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Torntv (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/torntv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TORNTV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Torntv (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/torntv"
        date = "2026-10-16"
    strings:
        $fam_name = "torntv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TORNTV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Torntv tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/torntv"
        date = "2026-10-16"
    strings:
        $attrib_str = "torntv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Torr (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/torr
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TORR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Torr (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/torr"
        date = "2026-10-16"
    strings:
        $fam_name = "torr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TORR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Torr tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/torr"
        date = "2026-10-16"
    strings:
        $attrib_str = "torr" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Torrenteasy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/torrenteasy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TORRENTEASY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Torrenteasy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/torrenteasy"
        date = "2026-10-16"
    strings:
        $fam_name = "torrenteasy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TORRENTEASY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Torrenteasy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/torrenteasy"
        date = "2026-10-16"
    strings:
        $attrib_str = "torrenteasy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tosthin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tosthin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOSTHIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tosthin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tosthin"
        date = "2026-10-16"
    strings:
        $fam_name = "tosthin" ascii wide nocase
        $alias_1 = "trojan.tosthin" ascii wide nocase
        $alias_2 = "downloader.tosthin" ascii wide nocase
        $alias_3 = "win32/tosthin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOSTHIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tosthin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tosthin"
        date = "2026-10-16"
    strings:
        $attrib_str = "tosthin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Totbrick (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/totbrick
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOTBRICK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Totbrick (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/totbrick"
        date = "2026-10-16"
    strings:
        $fam_name = "totbrick" ascii wide nocase
        $alias_1 = "trojan.totbrick" ascii wide nocase
        $alias_2 = "downloader.totbrick" ascii wide nocase
        $alias_3 = "win32/totbrick" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOTBRICK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Totbrick tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/totbrick"
        date = "2026-10-16"
    strings:
        $attrib_str = "totbrick" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tougle (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tougle
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOUGLE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tougle (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tougle"
        date = "2026-10-16"
    strings:
        $fam_name = "tougle" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOUGLE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tougle tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tougle"
        date = "2026-10-16"
    strings:
        $attrib_str = "tougle" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tovicrypt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tovicrypt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOVICRYPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tovicrypt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tovicrypt"
        date = "2026-10-16"
    strings:
        $fam_name = "tovicrypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOVICRYPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tovicrypt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tovicrypt"
        date = "2026-10-16"
    strings:
        $attrib_str = "tovicrypt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tovus (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tovus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TOVUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tovus (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tovus"
        date = "2026-10-16"
    strings:
        $fam_name = "tovus" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TOVUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tovus tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tovus"
        date = "2026-10-16"
    strings:
        $attrib_str = "tovus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tpyn (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tpyn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TPYN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tpyn (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tpyn"
        date = "2026-10-16"
    strings:
        $fam_name = "tpyn" ascii wide nocase
        $alias_1 = "trojan:win32/tpyn" ascii wide nocase
        $alias_2 = "backdoor:win32/tpyn" ascii wide nocase
        $alias_3 = "trojan.win32.tpyn" ascii wide nocase
        $alias_4 = "win32/tpyn" ascii wide nocase
        $alias_5 = "heur:trojan.win32.tpyn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TPYN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tpyn tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tpyn"
        date = "2026-10-16"
    strings:
        $attrib_str = "tpyn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Trabin (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trabin
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRABIN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trabin (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trabin"
        date = "2026-10-16"
    strings:
        $fam_name = "trabin" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRABIN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trabin tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trabin"
        date = "2026-10-16"
    strings:
        $attrib_str = "trabin" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tracur (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tracur
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRACUR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tracur (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tracur"
        date = "2026-10-16"
    strings:
        $fam_name = "tracur" ascii wide nocase
        $alias_1 = "trojan.tracur" ascii wide nocase
        $alias_2 = "downloader.tracur" ascii wide nocase
        $alias_3 = "win32/tracur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRACUR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tracur tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tracur"
        date = "2026-10-16"
    strings:
        $attrib_str = "tracur" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Trafog (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trafog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRAFOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trafog (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trafog"
        date = "2026-10-16"
    strings:
        $fam_name = "trafog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRAFOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trafog tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trafog"
        date = "2026-10-16"
    strings:
        $attrib_str = "trafog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Trainer (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trainer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRAINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trainer (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trainer"
        date = "2026-10-16"
    strings:
        $fam_name = "trainer" ascii wide nocase
        $alias_1 = "hacktool.trainer" ascii wide nocase
        $alias_2 = "riskware.gamehack" ascii wide nocase
        $alias_3 = "trojan.dropper.trainer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRAINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trainer tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trainer"
        date = "2026-10-16"
    strings:
        $attrib_str = "trainer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Transmit (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/transmit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRANSMIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Transmit (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/transmit"
        date = "2026-10-16"
    strings:
        $fam_name = "transmit" ascii wide nocase
        $alias_1 = "hacktool.transmit" ascii wide nocase
        $alias_2 = "riskware.netcat" ascii wide nocase
        $alias_3 = "tool.tunnel" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRANSMIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Transmit tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/transmit"
        date = "2026-10-16"
    strings:
        $attrib_str = "transmit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Trash (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trash
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRASH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trash (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trash"
        date = "2026-10-16"
    strings:
        $fam_name = "trash" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRASH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trash tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trash"
        date = "2026-10-16"
    strings:
        $attrib_str = "trash" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Travnet (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/travnet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRAVNET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Travnet (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/travnet"
        date = "2026-10-16"
    strings:
        $fam_name = "travnet" ascii wide nocase
        $alias_1 = "apt.nettraveler" ascii wide nocase
        $alias_2 = "trojan.travnet" ascii wide nocase
        $alias_3 = "spyware.nettraveler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRAVNET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Travnet tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/travnet"
        date = "2026-10-16"
    strings:
        $attrib_str = "travnet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Trialkiller (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trialkiller
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRIALKILLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trialkiller (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trialkiller"
        date = "2026-10-16"
    strings:
        $fam_name = "trialkiller" ascii wide nocase
        $alias_1 = "hacktool.trialkiller" ascii wide nocase
        $alias_2 = "riskware.crack" ascii wide nocase
        $alias_3 = "win32/keygen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRIALKILLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trialkiller tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trialkiller"
        date = "2026-10-16"
    strings:
        $attrib_str = "trialkiller" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Trick (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trick
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRICK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trick (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trick"
        date = "2026-10-16"
    strings:
        $fam_name = "trick" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRICK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trick tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trick"
        date = "2026-10-16"
    strings:
        $attrib_str = "trick" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Trickbot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trickbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRICKBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trickbot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trickbot"
        date = "2026-10-16"
    strings:
        $fam_name = "trickbot" ascii wide nocase
        $alias_1 = "trickbot" ascii wide nocase
        $alias_2 = "trickloader" ascii wide nocase
        $alias_3 = "totep" ascii wide nocase
        $alias_4 = "totbrick" ascii wide nocase
        $alias_5 = "tspy_trickload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRICKBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trickbot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trickbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "trickbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Trickster (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trickster
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRICKSTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trickster (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trickster"
        date = "2026-10-16"
    strings:
        $fam_name = "trickster" ascii wide nocase
        $alias_1 = "trojan:win32/trickster" ascii wide nocase
        $alias_2 = "trickbot" ascii wide nocase
        $alias_3 = "trickloader" ascii wide nocase
        $alias_4 = "trojan-banker.win32.trickster" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRICKSTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trickster tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trickster"
        date = "2026-10-16"
    strings:
        $attrib_str = "trickster" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Trilon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trilon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRILON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trilon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trilon"
        date = "2026-10-16"
    strings:
        $fam_name = "trilon" ascii wide nocase
        $alias_1 = "trojan.trilon" ascii wide nocase
        $alias_2 = "downloader.trilon" ascii wide nocase
        $alias_3 = "win32/trilon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRILON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trilon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trilon"
        date = "2026-10-16"
    strings:
        $attrib_str = "trilon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Trioris (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trioris
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRIORIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trioris (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trioris"
        date = "2026-10-16"
    strings:
        $fam_name = "trioris" ascii wide nocase
        $alias_1 = "trojan.trioris" ascii wide nocase
        $alias_2 = "downloader.trioris" ascii wide nocase
        $alias_3 = "win32/trioris" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRIORIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trioris tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trioris"
        date = "2026-10-16"
    strings:
        $attrib_str = "trioris" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Triusor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/triusor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRIUSOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Triusor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/triusor"
        date = "2026-10-16"
    strings:
        $fam_name = "triusor" ascii wide nocase
        $alias_1 = "triusor" ascii wide nocase
        $alias_2 = "trojan:win32/triusor" ascii wide nocase
        $alias_3 = "trojan.triusor" ascii wide nocase
        $alias_4 = "downloader.triusor" ascii wide nocase
        $alias_5 = "win32/triusor" ascii wide nocase
        $alias_6 = "triusor dropper" ascii wide nocase
        $alias_7 = "trojan:win32/triusor.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRIUSOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Triusor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/triusor"
        date = "2026-10-16"
    strings:
        $attrib_str = "triusor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Trjgen (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trjgen
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRJGEN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trjgen (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trjgen"
        date = "2026-10-16"
    strings:
        $fam_name = "trjgen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRJGEN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trjgen tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trjgen"
        date = "2026-10-16"
    strings:
        $attrib_str = "trjgen" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Trojanbanker (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trojanbanker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TROJANBANKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trojanbanker (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trojanbanker"
        date = "2026-10-16"
    strings:
        $fam_name = "trojanbanker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TROJANBANKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trojanbanker tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trojanbanker"
        date = "2026-10-16"
    strings:
        $attrib_str = "trojanbanker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Trojna (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trojna
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TROJNA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trojna (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trojna"
        date = "2026-10-16"
    strings:
        $fam_name = "trojna" ascii wide nocase
        $alias_1 = "trojna$" ascii wide nocase
        $alias_2 = "backdoor.trojna" ascii wide nocase
        $alias_3 = "trojan.win32.trojna" ascii wide nocase
        $alias_4 = "trojna 1.0" ascii wide nocase
        $alias_5 = "backdoor:win32/trojna" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TROJNA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trojna tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trojna"
        date = "2026-10-16"
    strings:
        $attrib_str = "trojna" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Troldesh (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/troldesh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TROLDESH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Troldesh (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/troldesh"
        date = "2026-10-16"
    strings:
        $fam_name = "troldesh" ascii wide nocase
        $alias_1 = "troldesh" ascii wide nocase
        $alias_2 = "shade" ascii wide nocase
        $alias_3 = "trojan.troldesh" ascii wide nocase
        $alias_4 = "ransom.shade" ascii wide nocase
        $alias_5 = "win32/troldesh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TROLDESH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Troldesh tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/troldesh"
        date = "2026-10-16"
    strings:
        $attrib_str = "troldesh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tron (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tron
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tron (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tron"
        date = "2026-10-16"
    strings:
        $fam_name = "tron" ascii wide nocase
        $alias_1 = "botnet.tron" ascii wide nocase
        $alias_2 = "trojan.tron" ascii wide nocase
        $alias_3 = "win32/tron" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tron tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tron"
        date = "2026-10-16"
    strings:
        $attrib_str = "tron" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Troxa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/troxa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TROXA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Troxa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/troxa"
        date = "2026-10-16"
    strings:
        $fam_name = "troxa" ascii wide nocase
        $alias_1 = "trojan.troxa" ascii wide nocase
        $alias_2 = "downloader.troxa" ascii wide nocase
        $alias_3 = "win32/troxa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TROXA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Troxa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/troxa"
        date = "2026-10-16"
    strings:
        $attrib_str = "troxa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Trpctrooper (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trpctrooper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRPCTROOPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trpctrooper (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trpctrooper"
        date = "2026-10-16"
    strings:
        $fam_name = "trpctrooper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRPCTROOPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trpctrooper tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trpctrooper"
        date = "2026-10-16"
    strings:
        $attrib_str = "trpctrooper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Truew (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/truew
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRUEW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Truew (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/truew"
        date = "2026-10-16"
    strings:
        $fam_name = "truew" ascii wide nocase
        $alias_1 = "ransom:win32/truew" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.truew" ascii wide nocase
        $alias_3 = "win32/truew" ascii wide nocase
        $alias_4 = "ransom.truew" ascii wide nocase
        $alias_5 = "truew ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRUEW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Truew tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/truew"
        date = "2026-10-16"
    strings:
        $attrib_str = "truew" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Trymedia (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/trymedia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TRYMEDIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trymedia (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trymedia"
        date = "2026-10-16"
    strings:
        $fam_name = "trymedia" ascii wide nocase
        $alias_1 = "adware:win32/trymedia" ascii wide nocase
        $alias_2 = "softwarebundler:win32/trymedia" ascii wide nocase
        $alias_3 = "pua:win32/trymedia" ascii wide nocase
        $alias_4 = "win32/trymedia" ascii wide nocase
        $alias_5 = "activemark trymedia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TRYMEDIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trymedia tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/trymedia"
        date = "2026-10-16"
    strings:
        $attrib_str = "trymedia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tsingsoft (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tsingsoft
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TSINGSOFT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tsingsoft (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tsingsoft"
        date = "2026-10-16"
    strings:
        $fam_name = "tsingsoft" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TSINGSOFT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tsingsoft tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tsingsoft"
        date = "2026-10-16"
    strings:
        $attrib_str = "tsingsoft" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tsklnk (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tsklnk
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TSKLNK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tsklnk (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tsklnk"
        date = "2026-10-16"
    strings:
        $fam_name = "tsklnk" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TSKLNK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tsklnk tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tsklnk"
        date = "2026-10-16"
    strings:
        $attrib_str = "tsklnk" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Tspy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tspy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tspy"
        date = "2026-10-16"
    strings:
        $fam_name = "tspy" ascii wide nocase
        $alias_1 = "spyware:win32/tspy" ascii wide nocase
        $alias_2 = "trojanspy:win32/tspy" ascii wide nocase
        $alias_3 = "trojan-spy.win32.tspy" ascii wide nocase
        $alias_4 = "win32/tspy" ascii wide nocase
        $alias_5 = "trojan.spy.tspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tspy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "tspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Tufik (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tufik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TUFIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tufik (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tufik"
        date = "2026-10-16"
    strings:
        $fam_name = "tufik" ascii wide nocase
        $alias_1 = "ransom:win32/tufik" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.tufik" ascii wide nocase
        $alias_3 = "trojan.tufik" ascii wide nocase
        $alias_4 = "win32/tufik" ascii wide nocase
        $alias_5 = "ransom:win32/tufik.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TUFIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tufik tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tufik"
        date = "2026-10-16"
    strings:
        $attrib_str = "tufik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tukrina (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tukrina
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TUKRINA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tukrina (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tukrina"
        date = "2026-10-16"
    strings:
        $fam_name = "tukrina" ascii wide nocase
        $alias_1 = "trojan.tukrina" ascii wide nocase
        $alias_2 = "downloader.tukrina" ascii wide nocase
        $alias_3 = "win32/tukrina" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TUKRINA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tukrina tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tukrina"
        date = "2026-10-16"
    strings:
        $attrib_str = "tukrina" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tulong (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tulong
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TULONG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tulong (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tulong"
        date = "2026-10-16"
    strings:
        $fam_name = "tulong" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TULONG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tulong tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tulong"
        date = "2026-10-16"
    strings:
        $attrib_str = "tulong" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Turkojan (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/turkojan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TURKOJAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Turkojan (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/turkojan"
        date = "2026-10-16"
    strings:
        $fam_name = "turkojan" ascii wide nocase
        $alias_1 = "turkojan" ascii wide nocase
        $alias_2 = "turkojan rat" ascii wide nocase
        $alias_3 = "backdoor:win32/turkojan" ascii wide nocase
        $alias_4 = "turkojan 4" ascii wide nocase
        $alias_5 = "trojan.turkojan" ascii wide nocase
        $alias_6 = "win32/turkojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TURKOJAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Turkojan tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/turkojan"
        date = "2026-10-16"
    strings:
        $attrib_str = "turkojan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Turla (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/turla
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TURLA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Turla (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/turla"
        date = "2026-10-16"
    strings:
        $fam_name = "turla" ascii wide nocase
        $alias_1 = "turla" ascii wide nocase
        $alias_2 = "snake" ascii wide nocase
        $alias_3 = "uroburos" ascii wide nocase
        $alias_4 = "waterbug" ascii wide nocase
        $alias_5 = "venomous bear" ascii wide nocase
        $alias_6 = "krypton" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TURLA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Turla tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/turla"
        date = "2026-10-16"
    strings:
        $attrib_str = "turla" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tuscas (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tuscas
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TUSCAS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tuscas (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tuscas"
        date = "2026-10-16"
    strings:
        $fam_name = "tuscas" ascii wide nocase
        $alias_1 = "adware:win32/tuscas" ascii wide nocase
        $alias_2 = "pua:win32/tuscas" ascii wide nocase
        $alias_3 = "adware.tuscas" ascii wide nocase
        $alias_4 = "win32/tuscas" ascii wide nocase
        $alias_5 = "adware:win32/tuscas.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TUSCAS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tuscas tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tuscas"
        date = "2026-10-16"
    strings:
        $attrib_str = "tuscas" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tvido (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tvido
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TVIDO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tvido (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tvido"
        date = "2026-10-16"
    strings:
        $fam_name = "tvido" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TVIDO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tvido tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tvido"
        date = "2026-10-16"
    strings:
        $attrib_str = "tvido" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tweakbit (Rogueware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tweakbit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TWEAKBIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tweakbit (Rogueware)"
        category = "Rogueware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tweakbit"
        date = "2026-10-16"
    strings:
        $fam_name = "tweakbit" ascii wide nocase
        $alias_1 = "pua:win32/tweakbit" ascii wide nocase
        $alias_2 = "pup.optional.tweakbit" ascii wide nocase
        $alias_3 = "program:win32/tweakbit" ascii wide nocase
        $alias_4 = "pua:win32/tweakbitpcrepairkit" ascii wide nocase
        $alias_5 = "pup.optional.tweakbitpcrepairkit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TWEAKBIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tweakbit tradecraft"
        category = "Rogueware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tweakbit"
        date = "2026-10-16"
    strings:
        $attrib_str = "tweakbit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tweakbitdu (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tweakbitdu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TWEAKBITDU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tweakbitdu (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tweakbitdu"
        date = "2026-10-16"
    strings:
        $fam_name = "tweakbitdu" ascii wide nocase
        $alias_1 = "pua:win32/tweakbitdu" ascii wide nocase
        $alias_2 = "program:win32/tweakbit" ascii wide nocase
        $alias_3 = "pup.optional.tweakbit" ascii wide nocase
        $alias_4 = "pua.win32.tweakbitdu" ascii wide nocase
        $alias_5 = "win32/tweakbitdriverupdater" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TWEAKBITDU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tweakbitdu tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tweakbitdu"
        date = "2026-10-16"
    strings:
        $attrib_str = "tweakbitdu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Tyhos (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tyhos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TYHOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tyhos (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tyhos"
        date = "2026-10-16"
    strings:
        $fam_name = "tyhos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TYHOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tyhos tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tyhos"
        date = "2026-10-16"
    strings:
        $attrib_str = "tyhos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Typic (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/typic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TYPIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Typic (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/typic"
        date = "2026-10-16"
    strings:
        $fam_name = "typic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TYPIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Typic tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/typic"
        date = "2026-10-16"
    strings:
        $attrib_str = "typic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tyuimoi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tyuimoi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TYUIMOI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tyuimoi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tyuimoi"
        date = "2026-10-16"
    strings:
        $fam_name = "tyuimoi" ascii wide nocase
        $alias_1 = "trojan.tyuimoi" ascii wide nocase
        $alias_2 = "downloader.tyuimoi" ascii wide nocase
        $alias_3 = "win32/tyuimoi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TYUIMOI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tyuimoi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tyuimoi"
        date = "2026-10-16"
    strings:
        $attrib_str = "tyuimoi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Tzabf (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/tzabf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_TZABF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Tzabf (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tzabf"
        date = "2026-10-16"
    strings:
        $fam_name = "tzabf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_TZABF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Tzabf tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/tzabf"
        date = "2026-10-16"
    strings:
        $attrib_str = "tzabf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for U8Taskservice (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/u8taskservice
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_U8TASKSERVICE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for U8Taskservice (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/u8taskservice"
        date = "2026-10-16"
    strings:
        $fam_name = "u8taskservice" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_U8TASKSERVICE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for U8Taskservice tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/u8taskservice"
        date = "2026-10-16"
    strings:
        $attrib_str = "u8taskservice" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Uacme (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uacme
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UACME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uacme (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uacme"
        date = "2026-10-16"
    strings:
        $fam_name = "uacme" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UACME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uacme tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uacme"
        date = "2026-10-16"
    strings:
        $attrib_str = "uacme" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ubar (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ubar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ubar (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ubar"
        date = "2026-10-16"
    strings:
        $fam_name = "ubar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ubar tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ubar"
        date = "2026-10-16"
    strings:
        $attrib_str = "ubar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ubibila (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ubibila
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UBIBILA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ubibila (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ubibila"
        date = "2026-10-16"
    strings:
        $fam_name = "ubibila" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UBIBILA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ubibila tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ubibila"
        date = "2026-10-16"
    strings:
        $attrib_str = "ubibila" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ubot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ubot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ubot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ubot"
        date = "2026-10-16"
    strings:
        $fam_name = "ubot" ascii wide nocase
        $alias_1 = "trojan.ubot" ascii wide nocase
        $alias_2 = "botnet.ubot" ascii wide nocase
        $alias_3 = "win32/ubot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ubot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ubot"
        date = "2026-10-16"
    strings:
        $attrib_str = "ubot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Udpos (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/udpos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UDPOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Udpos (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/udpos"
        date = "2026-10-16"
    strings:
        $fam_name = "udpos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UDPOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Udpos tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/udpos"
        date = "2026-10-16"
    strings:
        $attrib_str = "udpos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Udslee (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/udslee
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UDSLEE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Udslee (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/udslee"
        date = "2026-10-16"
    strings:
        $fam_name = "udslee" ascii wide nocase
        $alias_1 = "trojan.udslee" ascii wide nocase
        $alias_2 = "downloader.udslee" ascii wide nocase
        $alias_3 = "win32/udslee" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UDSLEE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Udslee tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/udslee"
        date = "2026-10-16"
    strings:
        $attrib_str = "udslee" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ufraie (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ufraie
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UFRAIE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ufraie (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ufraie"
        date = "2026-10-16"
    strings:
        $fam_name = "ufraie" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UFRAIE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ufraie tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ufraie"
        date = "2026-10-16"
    strings:
        $attrib_str = "ufraie" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Uiwao0Sam (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uiwao0sam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UIWAO0SAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uiwao0Sam (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uiwao0sam"
        date = "2026-10-16"
    strings:
        $fam_name = "uiwao0sam" ascii wide nocase
        $alias_1 = "trojan.generic.uiwao0sam" ascii wide nocase
        $alias_2 = "malware.obfuscated.dga" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UIWAO0SAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uiwao0Sam tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uiwao0sam"
        date = "2026-10-16"
    strings:
        $attrib_str = "uiwao0sam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Uiwaowr6Xsaje (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uiwaowr6xsaje
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UIWAOWR6XSAJE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uiwaowr6Xsaje (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uiwaowr6xsaje"
        date = "2026-10-16"
    strings:
        $fam_name = "uiwaowr6xsaje" ascii wide nocase
        $alias_1 = "trojan.generic.uiwaowr6xsaje" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UIWAOWR6XSAJE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uiwaowr6Xsaje tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uiwaowr6xsaje"
        date = "2026-10-16"
    strings:
        $attrib_str = "uiwaowr6xsaje" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Uk_Splitter (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uk_splitter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UK_SPLITTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uk_Splitter (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uk_splitter"
        date = "2026-10-16"
    strings:
        $fam_name = "uk_splitter" ascii wide nocase
        $alias_1 = "uk splitter 1.2" ascii wide nocase
        $alias_2 = "hacktool.win32.uksplitter" ascii wide nocase
        $alias_3 = "binder.uksplitter" ascii wide nocase
        $alias_4 = "uk splitter pro" ascii wide nocase
        $alias_5 = "uk-crew splitter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UK_SPLITTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uk_Splitter tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uk_splitter"
        date = "2026-10-16"
    strings:
        $attrib_str = "uk_splitter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ukpa (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ukpa
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UKPA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ukpa (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ukpa"
        date = "2026-10-16"
    strings:
        $fam_name = "ukpa" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UKPA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ukpa tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ukpa"
        date = "2026-10-16"
    strings:
        $attrib_str = "ukpa" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ulise (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ulise
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ULISE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ulise (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ulise"
        date = "2026-10-16"
    strings:
        $fam_name = "ulise" ascii wide nocase
        $alias_1 = "trojan-downloader.win32.ulise" ascii wide nocase
        $alias_2 = "trojan:win32/ulise" ascii wide nocase
        $alias_3 = "trojandownloader:win32/ulise" ascii wide nocase
        $alias_4 = "trojan.win32.ulise" ascii wide nocase
        $alias_5 = "win32/ulise.downloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ULISE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ulise tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ulise"
        date = "2026-10-16"
    strings:
        $attrib_str = "ulise" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Uloader (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ULOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uloader (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uloader"
        date = "2026-10-16"
    strings:
        $fam_name = "uloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ULOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uloader tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "uloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ulpm (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ulpm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ULPM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ulpm (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ulpm"
        date = "2026-10-16"
    strings:
        $fam_name = "ulpm" ascii wide nocase
        $alias_1 = "adware:win32/ulpm" ascii wide nocase
        $alias_2 = "tr/crypt.ulpm.gen" ascii wide nocase
        $alias_3 = "pua:win32/ulpm" ascii wide nocase
        $alias_4 = "adware.win32.ulpm" ascii wide nocase
        $alias_5 = "win32/ulpm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ULPM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ulpm tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ulpm"
        date = "2026-10-16"
    strings:
        $attrib_str = "ulpm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ultrasurf (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ultrasurf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ULTRASURF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ultrasurf (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ultrasurf"
        date = "2026-10-16"
    strings:
        $fam_name = "ultrasurf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ULTRASURF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ultrasurf tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ultrasurf"
        date = "2026-10-16"
    strings:
        $attrib_str = "ultrasurf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ulysses (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ulysses
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ULYSSES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ulysses (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ulysses"
        date = "2026-10-16"
    strings:
        $fam_name = "ulysses" ascii wide nocase
        $alias_1 = "ulysses rat" ascii wide nocase
        $alias_2 = "trojan.ulysses" ascii wide nocase
        $alias_3 = "backdoor.win32.ulysses" ascii wide nocase
        $alias_4 = "ulysses 1.0" ascii wide nocase
        $alias_5 = "backdoor:win32/ulysses" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ULYSSES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ulysses tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ulysses"
        date = "2026-10-16"
    strings:
        $attrib_str = "ulysses" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Umbald (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/umbald
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UMBALD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Umbald (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/umbald"
        date = "2026-10-16"
    strings:
        $fam_name = "umbald" ascii wide nocase
        $alias_1 = "ransom:win32/umbald" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.umbald" ascii wide nocase
        $alias_3 = "win32/umbald" ascii wide nocase
        $alias_4 = "umbald ransomware" ascii wide nocase
        $alias_5 = "ransom.umbald" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UMBALD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Umbald tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/umbald"
        date = "2026-10-16"
    strings:
        $attrib_str = "umbald" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Umbra (Loader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/umbra
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UMBRA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Umbra (Loader)"
        category = "Loader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/umbra"
        date = "2026-10-16"
    strings:
        $fam_name = "umbra" ascii wide nocase
        $alias_1 = "umbra loader" ascii wide nocase
        $alias_2 = "trojan:win32/umbra" ascii wide nocase
        $alias_3 = "backdoor:win32/umbra" ascii wide nocase
        $alias_4 = "trojan.win32.umbra" ascii wide nocase
        $alias_5 = "win32/umbraloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UMBRA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Umbra tradecraft"
        category = "Loader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/umbra"
        date = "2026-10-16"
    strings:
        $attrib_str = "umbra" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Umgfxgkazyg (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/umgfxgkazyg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UMGFXGKAZYG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Umgfxgkazyg (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/umgfxgkazyg"
        date = "2026-10-16"
    strings:
        $fam_name = "umgfxgkazyg" ascii wide nocase
        $alias_1 = "trojan.generic.umgfxgkazyg" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UMGFXGKAZYG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Umgfxgkazyg tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/umgfxgkazyg"
        date = "2026-10-16"
    strings:
        $attrib_str = "umgfxgkazyg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Umqabaxnjogc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/umqabaxnjogc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UMQABAXNJOGC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Umqabaxnjogc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/umqabaxnjogc"
        date = "2026-10-16"
    strings:
        $fam_name = "umqabaxnjogc" ascii wide nocase
        $alias_1 = "trojan.generic.umqabaxnjogc" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UMQABAXNJOGC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Umqabaxnjogc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/umqabaxnjogc"
        date = "2026-10-16"
    strings:
        $attrib_str = "umqabaxnjogc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Uniblue (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uniblue
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UNIBLUE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uniblue (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uniblue"
        date = "2026-10-16"
    strings:
        $fam_name = "uniblue" ascii wide nocase
        $alias_1 = "pua:win32/uniblue" ascii wide nocase
        $alias_2 = "program:win32/uniblue" ascii wide nocase
        $alias_3 = "pup.optional.uniblue" ascii wide nocase
        $alias_4 = "registrybooster" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UNIBLUE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uniblue tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uniblue"
        date = "2026-10-16"
    strings:
        $attrib_str = "uniblue" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Unigo (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/unigo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UNIGO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Unigo (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/unigo"
        date = "2026-10-16"
    strings:
        $fam_name = "unigo" ascii wide nocase
        $alias_1 = "adware.unigo" ascii wide nocase
        $alias_2 = "pup.unigo" ascii wide nocase
        $alias_3 = "browsermodifier:win32/unigo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UNIGO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Unigo tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/unigo"
        date = "2026-10-16"
    strings:
        $attrib_str = "unigo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Universal1337 (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/universal1337
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UNIVERSAL1337_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Universal1337 (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/universal1337"
        date = "2026-10-16"
    strings:
        $fam_name = "universal1337" ascii wide nocase
        $alias_1 = "universal 1337" ascii wide nocase
        $alias_2 = "trojan.universal1337" ascii wide nocase
        $alias_3 = "universal1337 by eddy-k" ascii wide nocase
        $alias_4 = "hacktool.universal1337" ascii wide nocase
        $alias_5 = "stealer.universal1337" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UNIVERSAL1337_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Universal1337 tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/universal1337"
        date = "2026-10-16"
    strings:
        $attrib_str = "universal1337" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Unpacked (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/unpacked
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UNPACKED_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Unpacked (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/unpacked"
        date = "2026-10-16"
    strings:
        $fam_name = "unpacked" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UNPACKED_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Unpacked tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/unpacked"
        date = "2026-10-16"
    strings:
        $attrib_str = "unpacked" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Unruy (Click_Fraud)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/unruy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UNRUY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Unruy (Click_Fraud)"
        category = "Click_Fraud"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/unruy"
        date = "2026-10-16"
    strings:
        $fam_name = "unruy" ascii wide nocase
        $alias_1 = "trojan:win32/unruy" ascii wide nocase
        $alias_2 = "trojan-clicker.win32.unruy" ascii wide nocase
        $alias_3 = "adware:win32/unruy" ascii wide nocase
        $alias_4 = "win32/unruy.clicker" ascii wide nocase
        $alias_5 = "trojan.win32.unruy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UNRUY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Unruy tradecraft"
        category = "Click_Fraud"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/unruy"
        date = "2026-10-16"
    strings:
        $attrib_str = "unruy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Unwaders (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/unwaders
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UNWADERS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Unwaders (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/unwaders"
        date = "2026-10-16"
    strings:
        $fam_name = "unwaders" ascii wide nocase
        $alias_1 = "adware:win32/unwaders" ascii wide nocase
        $alias_2 = "pua:win32/unwaders" ascii wide nocase
        $alias_3 = "misleading:win32/unwaders" ascii wide nocase
        $alias_4 = "adware.unwaders" ascii wide nocase
        $alias_5 = "program:win32/unwaders.a!ml" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UNWADERS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Unwaders tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/unwaders"
        date = "2026-10-16"
    strings:
        $attrib_str = "unwaders" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Upackdam (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/upackdam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UPACKDAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Upackdam (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/upackdam"
        date = "2026-10-16"
    strings:
        $fam_name = "upackdam" ascii wide nocase
        $alias_1 = "packer.upack" ascii wide nocase
        $alias_2 = "win32/upack" ascii wide nocase
        $alias_3 = "trojan.packed.upackdam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UPACKDAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Upackdam tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/upackdam"
        date = "2026-10-16"
    strings:
        $attrib_str = "upackdam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Upadter (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/upadter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UPADTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Upadter (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/upadter"
        date = "2026-10-16"
    strings:
        $fam_name = "upadter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UPADTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Upadter tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/upadter"
        date = "2026-10-16"
    strings:
        $attrib_str = "upadter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Upantix (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/upantix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UPANTIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Upantix (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/upantix"
        date = "2026-10-16"
    strings:
        $fam_name = "upantix" ascii wide nocase
        $alias_1 = "trojandownloader:win32/upantix" ascii wide nocase
        $alias_2 = "trojan:win32/upantix" ascii wide nocase
        $alias_3 = "trojan.upantix" ascii wide nocase
        $alias_4 = "win32/upantix" ascii wide nocase
        $alias_5 = "trojandownloader:win32/upantix.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UPANTIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Upantix tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/upantix"
        date = "2026-10-16"
    strings:
        $attrib_str = "upantix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Upatre (Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/upatre
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UPATRE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Upatre (Downloader)"
        category = "Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/upatre"
        date = "2026-10-16"
    strings:
        $fam_name = "upatre" ascii wide nocase
        $alias_1 = "upatre" ascii wide nocase
        $alias_2 = "downloader.upatre" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UPATRE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Upatre tradecraft"
        category = "Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/upatre"
        date = "2026-10-16"
    strings:
        $attrib_str = "upatre" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Updater (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/updater
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UPDATER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Updater (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/updater"
        date = "2026-10-16"
    strings:
        $fam_name = "updater" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UPDATER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Updater tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/updater"
        date = "2026-10-16"
    strings:
        $attrib_str = "updater" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Updatestar (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/updatestar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UPDATESTAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Updatestar (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/updatestar"
        date = "2026-10-16"
    strings:
        $fam_name = "updatestar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UPDATESTAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Updatestar tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/updatestar"
        date = "2026-10-16"
    strings:
        $attrib_str = "updatestar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Upkm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/upkm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UPKM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Upkm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/upkm"
        date = "2026-10-16"
    strings:
        $fam_name = "upkm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UPKM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Upkm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/upkm"
        date = "2026-10-16"
    strings:
        $attrib_str = "upkm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Uploader (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uploader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UPLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uploader (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uploader"
        date = "2026-10-16"
    strings:
        $fam_name = "uploader" ascii wide nocase
        $alias_1 = "trojan.uploader" ascii wide nocase
        $alias_2 = "hacktool.uploader" ascii wide nocase
        $alias_3 = "exfiltration.tool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UPLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uploader tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uploader"
        date = "2026-10-16"
    strings:
        $attrib_str = "uploader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Uptodown (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uptodown
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UPTODOWN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uptodown (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uptodown"
        date = "2026-10-16"
    strings:
        $fam_name = "uptodown" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UPTODOWN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uptodown tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uptodown"
        date = "2026-10-16"
    strings:
        $attrib_str = "uptodown" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Urausy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/urausy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_URAUSY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Urausy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/urausy"
        date = "2026-10-16"
    strings:
        $fam_name = "urausy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_URAUSY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Urausy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/urausy"
        date = "2026-10-16"
    strings:
        $attrib_str = "urausy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Urcs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/urcs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_URCS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Urcs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/urcs"
        date = "2026-10-16"
    strings:
        $fam_name = "urcs" ascii wide nocase
        $alias_1 = "trojan.urcs" ascii wide nocase
        $alias_2 = "backdoor.urcbot" ascii wide nocase
        $alias_3 = "win32/urcs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_URCS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Urcs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/urcs"
        date = "2026-10-16"
    strings:
        $attrib_str = "urcs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Urelas (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/urelas
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_URELAS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Urelas (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/urelas"
        date = "2026-10-16"
    strings:
        $fam_name = "urelas" ascii wide nocase
        $alias_1 = "urelas" ascii wide nocase
        $alias_2 = "trojan:win32/urelas" ascii wide nocase
        $alias_3 = "trojan.urelas" ascii wide nocase
        $alias_4 = "win32/urelas" ascii wide nocase
        $alias_5 = "infostealer.urelas" ascii wide nocase
        $alias_6 = "trojan.win32.urelas" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_URELAS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Urelas tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/urelas"
        date = "2026-10-16"
    strings:
        $attrib_str = "urelas" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ursnif (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ursnif
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_URSNIF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ursnif (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ursnif"
        date = "2026-10-16"
    strings:
        $fam_name = "ursnif" ascii wide nocase
        $alias_1 = "ursnif" ascii wide nocase
        $alias_2 = "gozi" ascii wide nocase
        $alias_3 = "gozi-isfb" ascii wide nocase
        $alias_4 = "isfb" ascii wide nocase
        $alias_5 = "dreambot" ascii wide nocase
        $alias_6 = "iap" ascii wide nocase
        $alias_7 = "saload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_URSNIF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ursnif tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ursnif"
        date = "2026-10-16"
    strings:
        $attrib_str = "ursnif" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ursnifdropper (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ursnifdropper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_URSNIFDROPPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ursnifdropper (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ursnifdropper"
        date = "2026-10-16"
    strings:
        $fam_name = "ursnifdropper" ascii wide nocase
        $alias_1 = "trojandropper.ursnif" ascii wide nocase
        $alias_2 = "downloader.ursnif" ascii wide nocase
        $alias_3 = "win32/ursnifdropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_URSNIFDROPPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ursnifdropper tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ursnifdropper"
        date = "2026-10-16"
    strings:
        $attrib_str = "ursnifdropper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ursu (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ursu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_URSU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ursu (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ursu"
        date = "2026-10-16"
    strings:
        $fam_name = "ursu" ascii wide nocase
        $alias_1 = "ursu" ascii wide nocase
        $alias_2 = "trojan:win32/ursu" ascii wide nocase
        $alias_3 = "trojan.msil.ursu" ascii wide nocase
        $alias_4 = "win32/ursu" ascii wide nocase
        $alias_5 = "downloader.ursu" ascii wide nocase
        $alias_6 = "ursu loader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_URSU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ursu tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ursu"
        date = "2026-10-16"
    strings:
        $attrib_str = "ursu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Ursumdt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ursumdt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_URSUMDT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ursumdt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ursumdt"
        date = "2026-10-16"
    strings:
        $fam_name = "ursumdt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_URSUMDT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ursumdt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ursumdt"
        date = "2026-10-16"
    strings:
        $attrib_str = "ursumdt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Uruasy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uruasy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_URUASY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uruasy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uruasy"
        date = "2026-10-16"
    strings:
        $fam_name = "uruasy" ascii wide nocase
        $alias_1 = "trojan.uruasy" ascii wide nocase
        $alias_2 = "downloader.uruasy" ascii wide nocase
        $alias_3 = "win32/uruasy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_URUASY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uruasy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uruasy"
        date = "2026-10-16"
    strings:
        $attrib_str = "uruasy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Usteal (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/usteal
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_USTEAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Usteal (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/usteal"
        date = "2026-10-16"
    strings:
        $fam_name = "usteal" ascii wide nocase
        $alias_1 = "trojan-psw.win32.usteal" ascii wide nocase
        $alias_2 = "pws:win32/usteal" ascii wide nocase
        $alias_3 = "trojan:win32/usteal" ascii wide nocase
        $alias_4 = "win32/usteal" ascii wide nocase
        $alias_5 = "trojan.usteal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_USTEAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Usteal tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/usteal"
        date = "2026-10-16"
    strings:
        $attrib_str = "usteal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Utoti (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/utoti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UTOTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Utoti (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/utoti"
        date = "2026-10-16"
    strings:
        $fam_name = "utoti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UTOTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Utoti tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/utoti"
        date = "2026-10-16"
    strings:
        $attrib_str = "utoti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Uwamson (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uwamson
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UWAMSON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uwamson (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uwamson"
        date = "2026-10-16"
    strings:
        $fam_name = "uwamson" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UWAMSON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uwamson tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uwamson"
        date = "2026-10-16"
    strings:
        $attrib_str = "uwamson" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Uztub (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uztub
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UZTUB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uztub (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uztub"
        date = "2026-10-16"
    strings:
        $fam_name = "uztub" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UZTUB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uztub tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uztub"
        date = "2026-10-16"
    strings:
        $attrib_str = "uztub" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Uztuby (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/uztuby
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_UZTUBY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Uztuby (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uztuby"
        date = "2026-10-16"
    strings:
        $fam_name = "uztuby" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_UZTUBY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Uztuby tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/uztuby"
        date = "2026-10-16"
    strings:
        $attrib_str = "uztuby" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vabushky (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vabushky
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VABUSHKY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vabushky (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vabushky"
        date = "2026-10-16"
    strings:
        $fam_name = "vabushky" ascii wide nocase
        $alias_1 = "ransom:win32/vabushky" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.vabushky" ascii wide nocase
        $alias_3 = "trojan.vabushky" ascii wide nocase
        $alias_4 = "win32/vabushky" ascii wide nocase
        $alias_5 = "ransom:win32/vabushky.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VABUSHKY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vabushky tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vabushky"
        date = "2026-10-16"
    strings:
        $attrib_str = "vabushky" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vakcune (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vakcune
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VAKCUNE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vakcune (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vakcune"
        date = "2026-10-16"
    strings:
        $fam_name = "vakcune" ascii wide nocase
        $alias_1 = "trojan.vakcune" ascii wide nocase
        $alias_2 = "downloader.vakcune" ascii wide nocase
        $alias_3 = "win32/vakcune" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VAKCUNE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vakcune tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vakcune"
        date = "2026-10-16"
    strings:
        $attrib_str = "vakcune" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vake (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vake
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VAKE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vake (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vake"
        date = "2026-10-16"
    strings:
        $fam_name = "vake" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VAKE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vake tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vake"
        date = "2026-10-16"
    strings:
        $attrib_str = "vake" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Valcaryx (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/valcaryx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VALCARYX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Valcaryx (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/valcaryx"
        date = "2026-10-16"
    strings:
        $fam_name = "valcaryx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VALCARYX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Valcaryx tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/valcaryx"
        date = "2026-10-16"
    strings:
        $attrib_str = "valcaryx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vampire (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vampire
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VAMPIRE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vampire (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vampire"
        date = "2026-10-16"
    strings:
        $fam_name = "vampire" ascii wide nocase
        $alias_1 = "vampire rat" ascii wide nocase
        $alias_2 = "backdoor.vampire" ascii wide nocase
        $alias_3 = "trojan.win32.vampire" ascii wide nocase
        $alias_4 = "vampire trojan" ascii wide nocase
        $alias_5 = "backdoor:win32/vampire" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VAMPIRE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vampire tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vampire"
        date = "2026-10-16"
    strings:
        $attrib_str = "vampire" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vanbot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vanbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VANBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vanbot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vanbot"
        date = "2026-10-16"
    strings:
        $fam_name = "vanbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VANBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vanbot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vanbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "vanbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vanilloader (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vanilloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VANILLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vanilloader (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vanilloader"
        date = "2026-10-16"
    strings:
        $fam_name = "vanilloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VANILLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vanilloader tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vanilloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "vanilloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vapsup (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vapsup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VAPSUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vapsup (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vapsup"
        date = "2026-10-16"
    strings:
        $fam_name = "vapsup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VAPSUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vapsup tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vapsup"
        date = "2026-10-16"
    strings:
        $attrib_str = "vapsup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vawtrak (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vawtrak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VAWTRAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vawtrak (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vawtrak"
        date = "2026-10-16"
    strings:
        $fam_name = "vawtrak" ascii wide nocase
        $alias_1 = "vawtrak" ascii wide nocase
        $alias_2 = "neverquest" ascii wide nocase
        $alias_3 = "snifula" ascii wide nocase
        $alias_4 = "win32/vawtrak" ascii wide nocase
        $alias_5 = "trojan.vawtrak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VAWTRAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vawtrak tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vawtrak"
        date = "2026-10-16"
    strings:
        $attrib_str = "vawtrak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vbcheman (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbcheman
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBCHEMAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbcheman (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbcheman"
        date = "2026-10-16"
    strings:
        $fam_name = "vbcheman" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBCHEMAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbcheman tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbcheman"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbcheman" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vbclone (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbclone
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBCLONE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbclone (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbclone"
        date = "2026-10-16"
    strings:
        $fam_name = "vbclone" ascii wide nocase
        $alias_1 = "trojan:win32/vbclone!rfn" ascii wide nocase
        $alias_2 = "trojan.vbclone" ascii wide nocase
        $alias_3 = "win32/vbclone" ascii wide nocase
        $alias_4 = "trojan.win32.vbclone" ascii wide nocase
        $alias_5 = "trojan:win32/vbclone.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBCLONE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbclone tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbclone"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbclone" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vbcode (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbcode
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBCODE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbcode (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbcode"
        date = "2026-10-16"
    strings:
        $fam_name = "vbcode" ascii wide nocase
        $alias_1 = "vbs.downloader" ascii wide nocase
        $alias_2 = "trojan.vbscript" ascii wide nocase
        $alias_3 = "macro.vbcode" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBCODE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbcode tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbcode"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbcode" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vbcryptent (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbcryptent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBCRYPTENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbcryptent (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbcryptent"
        date = "2026-10-16"
    strings:
        $fam_name = "vbcryptent" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBCRYPTENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbcryptent tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbcryptent"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbcryptent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vbcryptor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbcryptor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBCRYPTOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbcryptor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbcryptor"
        date = "2026-10-16"
    strings:
        $fam_name = "vbcryptor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBCRYPTOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbcryptor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbcryptor"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbcryptor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vbdrop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbdrop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBDROP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbdrop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbdrop"
        date = "2026-10-16"
    strings:
        $fam_name = "vbdrop" ascii wide nocase
        $alias_1 = "trojan.dropper.vbs" ascii wide nocase
        $alias_2 = "vbs/dropper" ascii wide nocase
        $alias_3 = "win32/vbdrop" ascii wide nocase
        $alias_4 = "trojan.vbdrop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBDROP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbdrop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbdrop"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbdrop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vbinder (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbinder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBINDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbinder (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbinder"
        date = "2026-10-16"
    strings:
        $fam_name = "vbinder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBINDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbinder tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbinder"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbinder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vbkeylog (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbkeylog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBKEYLOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbkeylog (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbkeylog"
        date = "2026-10-16"
    strings:
        $fam_name = "vbkeylog" ascii wide nocase
        $alias_1 = "keylogger.vb" ascii wide nocase
        $alias_2 = "trojanspy.vbkeylog" ascii wide nocase
        $alias_3 = "vb.keylogger" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBKEYLOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbkeylog tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbkeylog"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbkeylog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vbklog (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbklog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBKLOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbklog (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbklog"
        date = "2026-10-16"
    strings:
        $fam_name = "vbklog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBKLOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbklog tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbklog"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbklog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vbkryjetor (Packer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbkryjetor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBKRYJETOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbkryjetor (Packer)"
        category = "Packer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbkryjetor"
        date = "2026-10-16"
    strings:
        $fam_name = "vbkryjetor" ascii wide nocase
        $alias_1 = "packer:win32/vbkryjetor" ascii wide nocase
        $alias_2 = "trojan:win32/vbkryjetor" ascii wide nocase
        $alias_3 = "crypter.vbkryjetor" ascii wide nocase
        $alias_4 = "win32/vbkryjetor.packer" ascii wide nocase
        $alias_5 = "trojan.vb.kryjetor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBKRYJETOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbkryjetor tradecraft"
        category = "Packer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbkryjetor"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbkryjetor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vbmod (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbmod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBMOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbmod (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbmod"
        date = "2026-10-16"
    strings:
        $fam_name = "vbmod" ascii wide nocase
        $alias_1 = "trojan.vbmod" ascii wide nocase
        $alias_2 = "worm.vbmod" ascii wide nocase
        $alias_3 = "vbs.dropper.generic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBMOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbmod tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbmod"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbmod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vbs_Worm_Generator (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vbs_worm_generator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VBS_WORM_GENERATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vbs_Worm_Generator (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbs_worm_generator"
        date = "2026-10-16"
    strings:
        $fam_name = "vbs_worm_generator" ascii wide nocase
        $alias_1 = "vbswg" ascii wide nocase
        $alias_2 = "vbs worm generator by [k]alamar" ascii wide nocase
        $alias_3 = "worm.vbswg" ascii wide nocase
        $alias_4 = "vbswg 1.50" ascii wide nocase
        $alias_5 = "vbswg 2.0" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VBS_WORM_GENERATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vbs_Worm_Generator tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vbs_worm_generator"
        date = "2026-10-16"
    strings:
        $attrib_str = "vbs_worm_generator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vedpoz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vedpoz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VEDPOZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vedpoz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vedpoz"
        date = "2026-10-16"
    strings:
        $fam_name = "vedpoz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VEDPOZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vedpoz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vedpoz"
        date = "2026-10-16"
    strings:
        $attrib_str = "vedpoz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vehidis (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vehidis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VEHIDIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vehidis (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vehidis"
        date = "2026-10-16"
    strings:
        $fam_name = "vehidis" ascii wide nocase
        $alias_1 = "ransom:win32/vehidis" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.vehidis" ascii wide nocase
        $alias_3 = "win32/vehidis" ascii wide nocase
        $alias_4 = "vehidis ransomware" ascii wide nocase
        $alias_5 = "ransom.vehidis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VEHIDIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vehidis tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vehidis"
        date = "2026-10-16"
    strings:
        $attrib_str = "vehidis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Veil (Virtool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/veil
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VEIL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Veil (Virtool)"
        category = "Virtool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/veil"
        date = "2026-10-16"
    strings:
        $fam_name = "veil" ascii wide nocase
        $alias_1 = "virtool:win32/veil" ascii wide nocase
        $alias_2 = "hacktool:win32/veil" ascii wide nocase
        $alias_3 = "win32/veil" ascii wide nocase
        $alias_4 = "veil-evasion" ascii wide nocase
        $alias_5 = "veil framework" ascii wide nocase
        $alias_6 = "tool:win32/veil" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VEIL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Veil tradecraft"
        category = "Virtool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/veil"
        date = "2026-10-16"
    strings:
        $attrib_str = "veil" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Veilev (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/veilev
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VEILEV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Veilev (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/veilev"
        date = "2026-10-16"
    strings:
        $fam_name = "veilev" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VEILEV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Veilev tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/veilev"
        date = "2026-10-16"
    strings:
        $attrib_str = "veilev" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vemply (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vemply
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VEMPLY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vemply (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vemply"
        date = "2026-10-16"
    strings:
        $fam_name = "vemply" ascii wide nocase
        $alias_1 = "ransom:win32/vemply" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.vemply" ascii wide nocase
        $alias_3 = "trojan.vemply" ascii wide nocase
        $alias_4 = "win32/vemply" ascii wide nocase
        $alias_5 = "ransom:win32/vemply.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VEMPLY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vemply tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vemply"
        date = "2026-10-16"
    strings:
        $attrib_str = "vemply" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vemptik (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vemptik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VEMPTIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vemptik (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vemptik"
        date = "2026-10-16"
    strings:
        $fam_name = "vemptik" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VEMPTIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vemptik tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vemptik"
        date = "2026-10-16"
    strings:
        $attrib_str = "vemptik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Venik (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/venik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VENIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Venik (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/venik"
        date = "2026-10-16"
    strings:
        $fam_name = "venik" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VENIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Venik tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/venik"
        date = "2026-10-16"
    strings:
        $attrib_str = "venik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Verecno (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/verecno
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VERECNO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Verecno (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/verecno"
        date = "2026-10-16"
    strings:
        $fam_name = "verecno" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VERECNO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Verecno tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/verecno"
        date = "2026-10-16"
    strings:
        $attrib_str = "verecno" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Veriato (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/veriato
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VERIATO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Veriato (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/veriato"
        date = "2026-10-16"
    strings:
        $fam_name = "veriato" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VERIATO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Veriato tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/veriato"
        date = "2026-10-16"
    strings:
        $attrib_str = "veriato" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Verti (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/verti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VERTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Verti (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/verti"
        date = "2026-10-16"
    strings:
        $fam_name = "verti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VERTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Verti tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/verti"
        date = "2026-10-16"
    strings:
        $attrib_str = "verti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vesenlosow (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vesenlosow
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VESENLOSOW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vesenlosow (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vesenlosow"
        date = "2026-10-16"
    strings:
        $fam_name = "vesenlosow" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.vesenlosow" ascii wide nocase
        $alias_3 = "heur.vesenlosow" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VESENLOSOW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vesenlosow tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vesenlosow"
        date = "2026-10-16"
    strings:
        $attrib_str = "vesenlosow" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vibem (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vibem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIBEM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vibem (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vibem"
        date = "2026-10-16"
    strings:
        $fam_name = "vibem" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIBEM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vibem tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vibem"
        date = "2026-10-16"
    strings:
        $attrib_str = "vibem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vidar (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vidar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIDAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vidar (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vidar"
        date = "2026-10-16"
    strings:
        $fam_name = "vidar" ascii wide nocase
        $alias_1 = "vidar" ascii wide nocase
        $alias_2 = "vidar stealer" ascii wide nocase
        $alias_3 = "trojan.vidar" ascii wide nocase
        $alias_4 = "spyware.vidarstealer" ascii wide nocase
        $alias_5 = "pws.win32.vidar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIDAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vidar tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vidar"
        date = "2026-10-16"
    strings:
        $attrib_str = "vidar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vidarstealer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vidarstealer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIDARSTEALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vidarstealer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vidarstealer"
        date = "2026-10-16"
    strings:
        $fam_name = "vidarstealer" ascii wide nocase
        $alias_1 = "trojan.vidar" ascii wide nocase
        $alias_2 = "spyware.vidarstealer" ascii wide nocase
        $alias_3 = "pws.win32.vidar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIDARSTEALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vidarstealer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vidarstealer"
        date = "2026-10-16"
    strings:
        $attrib_str = "vidarstealer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Viddyhd (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/viddyhd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIDDYHD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Viddyhd (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/viddyhd"
        date = "2026-10-16"
    strings:
        $fam_name = "viddyhd" ascii wide nocase
        $alias_1 = "adware.viddyhd" ascii wide nocase
        $alias_2 = "pup.viddyhd" ascii wide nocase
        $alias_3 = "win32/adware.viddyhd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIDDYHD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Viddyhd tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/viddyhd"
        date = "2026-10-16"
    strings:
        $attrib_str = "viddyhd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vidro (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vidro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIDRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vidro (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vidro"
        date = "2026-10-16"
    strings:
        $fam_name = "vidro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIDRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vidro tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vidro"
        date = "2026-10-16"
    strings:
        $attrib_str = "vidro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vigorf (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vigorf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIGORF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vigorf (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vigorf"
        date = "2026-10-16"
    strings:
        $fam_name = "vigorf" ascii wide nocase
        $alias_1 = "trojan:win32/vigorf.a" ascii wide nocase
        $alias_2 = "trojan:win32/vigorf" ascii wide nocase
        $alias_3 = "trojandownloader:win32/vigorf" ascii wide nocase
        $alias_4 = "win32/vigorf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIGORF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vigorf tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vigorf"
        date = "2026-10-16"
    strings:
        $attrib_str = "vigorf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vigram (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vigram
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIGRAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vigram (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vigram"
        date = "2026-10-16"
    strings:
        $fam_name = "vigram" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIGRAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vigram tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vigram"
        date = "2026-10-16"
    strings:
        $attrib_str = "vigram" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Viking (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/viking
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIKING_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Viking (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/viking"
        date = "2026-10-16"
    strings:
        $fam_name = "viking" ascii wide nocase
        $alias_1 = "virus:win32/viking" ascii wide nocase
        $alias_2 = "worm.win32.viking" ascii wide nocase
        $alias_3 = "pe_viking" ascii wide nocase
        $alias_4 = "w32.viking" ascii wide nocase
        $alias_5 = "win32/viking" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIKING_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Viking tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/viking"
        date = "2026-10-16"
    strings:
        $attrib_str = "viking" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vilsel (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vilsel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VILSEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vilsel (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vilsel"
        date = "2026-10-16"
    strings:
        $fam_name = "vilsel" ascii wide nocase
        $alias_1 = "trojan:win32/vilsel" ascii wide nocase
        $alias_2 = "trojan.win32.vilsel" ascii wide nocase
        $alias_3 = "trojan.vilsel" ascii wide nocase
        $alias_4 = "trojan:win32/vilsel!mtb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VILSEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vilsel tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vilsel"
        date = "2026-10-16"
    strings:
        $attrib_str = "vilsel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vimditator (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vimditator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIMDITATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vimditator (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vimditator"
        date = "2026-10-16"
    strings:
        $fam_name = "vimditator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIMDITATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vimditator tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vimditator"
        date = "2026-10-16"
    strings:
        $attrib_str = "vimditator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vindor (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vindor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VINDOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vindor (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vindor"
        date = "2026-10-16"
    strings:
        $fam_name = "vindor" ascii wide nocase
        $alias_1 = "trojan:win32/vindor" ascii wide nocase
        $alias_2 = "trojan.win32.vindor" ascii wide nocase
        $alias_3 = "win32/vindor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VINDOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vindor tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vindor"
        date = "2026-10-16"
    strings:
        $attrib_str = "vindor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Virgilio (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/virgilio
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIRGILIO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Virgilio (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virgilio"
        date = "2026-10-16"
    strings:
        $fam_name = "virgilio" ascii wide nocase
        $alias_1 = "trojan.virgilio" ascii wide nocase
        $alias_2 = "downloader.virgilio" ascii wide nocase
        $alias_3 = "win32/virgilio" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIRGILIO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Virgilio tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virgilio"
        date = "2026-10-16"
    strings:
        $attrib_str = "virgilio" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Virledi (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/virledi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIRLEDI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Virledi (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virledi"
        date = "2026-10-16"
    strings:
        $fam_name = "virledi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIRLEDI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Virledi tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virledi"
        date = "2026-10-16"
    strings:
        $attrib_str = "virledi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Virlock (Ransomware_File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/virlock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIRLOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Virlock (Ransomware_File_Infector)"
        category = "Ransomware_File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virlock"
        date = "2026-10-16"
    strings:
        $fam_name = "virlock" ascii wide nocase
        $alias_1 = "virlock" ascii wide nocase
        $alias_2 = "virransom" ascii wide nocase
        $alias_3 = "polymorphic locker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIRLOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Virlock tradecraft"
        category = "Ransomware_File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virlock"
        date = "2026-10-16"
    strings:
        $attrib_str = "virlock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Virtu (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/virtu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIRTU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Virtu (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virtu"
        date = "2026-10-16"
    strings:
        $fam_name = "virtu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIRTU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Virtu tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virtu"
        date = "2026-10-16"
    strings:
        $attrib_str = "virtu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Virtum (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/virtum
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIRTUM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Virtum (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virtum"
        date = "2026-10-16"
    strings:
        $fam_name = "virtum" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIRTUM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Virtum tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virtum"
        date = "2026-10-16"
    strings:
        $attrib_str = "virtum" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Virtumod (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/virtumod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIRTUMOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Virtumod (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virtumod"
        date = "2026-10-16"
    strings:
        $fam_name = "virtumod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIRTUMOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Virtumod tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virtumod"
        date = "2026-10-16"
    strings:
        $attrib_str = "virtumod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Virtumonde (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/virtumonde
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIRTUMONDE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Virtumonde (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virtumonde"
        date = "2026-10-16"
    strings:
        $fam_name = "virtumonde" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIRTUMONDE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Virtumonde tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virtumonde"
        date = "2026-10-16"
    strings:
        $attrib_str = "virtumonde" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Viruscure (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/viruscure
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIRUSCURE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Viruscure (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/viruscure"
        date = "2026-10-16"
    strings:
        $fam_name = "viruscure" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIRUSCURE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Viruscure tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/viruscure"
        date = "2026-10-16"
    strings:
        $attrib_str = "viruscure" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Virut (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/virut
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIRUT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Virut (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virut"
        date = "2026-10-16"
    strings:
        $fam_name = "virut" ascii wide nocase
        $alias_1 = "virut" ascii wide nocase
        $alias_2 = "win32/virut" ascii wide nocase
        $alias_3 = "virux" ascii wide nocase
        $alias_4 = "virut.ce" ascii wide nocase
        $alias_5 = "w32.virut.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIRUT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Virut tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/virut"
        date = "2026-10-16"
    strings:
        $attrib_str = "virut" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Visicom (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/visicom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VISICOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Visicom (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/visicom"
        date = "2026-10-16"
    strings:
        $fam_name = "visicom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VISICOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Visicom tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/visicom"
        date = "2026-10-16"
    strings:
        $attrib_str = "visicom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vitro (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vitro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VITRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vitro (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vitro"
        date = "2026-10-16"
    strings:
        $fam_name = "vitro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VITRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vitro tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vitro"
        date = "2026-10-16"
    strings:
        $attrib_str = "vitro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vitruvian (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vitruvian
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VITRUVIAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vitruvian (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vitruvian"
        date = "2026-10-16"
    strings:
        $fam_name = "vitruvian" ascii wide nocase
        $alias_1 = "trojan.vitruvian" ascii wide nocase
        $alias_2 = "downloader.vitruvian" ascii wide nocase
        $alias_3 = "win32/vitruvian" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VITRUVIAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vitruvian tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vitruvian"
        date = "2026-10-16"
    strings:
        $attrib_str = "vitruvian" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vittalia (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vittalia
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VITTALIA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vittalia (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vittalia"
        date = "2026-10-16"
    strings:
        $fam_name = "vittalia" ascii wide nocase
        $alias_1 = "adware.vittalia" ascii wide nocase
        $alias_2 = "pup.optional.vittalia" ascii wide nocase
        $alias_3 = "pua:win32/vittalia" ascii wide nocase
        $alias_4 = "browserhijacker.vittalia" ascii wide nocase
        $alias_5 = "adware.win32.vittalia" ascii wide nocase
        $alias_6 = "win32/vittalia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VITTALIA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vittalia tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vittalia"
        date = "2026-10-16"
    strings:
        $attrib_str = "vittalia" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vittaliaent (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vittaliaent
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VITTALIAENT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vittaliaent (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vittaliaent"
        date = "2026-10-16"
    strings:
        $fam_name = "vittaliaent" ascii wide nocase
        $alias_1 = "adware:win32/vittaliaent" ascii wide nocase
        $alias_2 = "program:win32/vittalia" ascii wide nocase
        $alias_3 = "pua:win32/vittalia" ascii wide nocase
        $alias_4 = "adware.win32.vittalia" ascii wide nocase
        $alias_5 = "win32/vittalia" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VITTALIAENT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vittaliaent tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vittaliaent"
        date = "2026-10-16"
    strings:
        $attrib_str = "vittaliaent" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vixenpanda (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vixenpanda
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIXENPANDA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vixenpanda (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vixenpanda"
        date = "2026-10-16"
    strings:
        $fam_name = "vixenpanda" ascii wide nocase
        $alias_1 = "apt15" ascii wide nocase
        $alias_2 = "ke3chang" ascii wide nocase
        $alias_3 = "playful dragon" ascii wide nocase
        $alias_4 = "mirage" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIXENPANDA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vixenpanda tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vixenpanda"
        date = "2026-10-16"
    strings:
        $attrib_str = "vixenpanda" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Vixup (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vixup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VIXUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vixup (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vixup"
        date = "2026-10-16"
    strings:
        $fam_name = "vixup" ascii wide nocase
        $alias_1 = "trojan.vixup" ascii wide nocase
        $alias_2 = "downloader.vixup" ascii wide nocase
        $alias_3 = "win32/vixup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VIXUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vixup tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vixup"
        date = "2026-10-16"
    strings:
        $attrib_str = "vixup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vjworm (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vjworm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VJWORM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vjworm (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vjworm"
        date = "2026-10-16"
    strings:
        $fam_name = "vjworm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VJWORM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vjworm tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vjworm"
        date = "2026-10-16"
    strings:
        $attrib_str = "vjworm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Vkbase (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vkbase
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VKBASE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vkbase (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vkbase"
        date = "2026-10-16"
    strings:
        $fam_name = "vkbase" ascii wide nocase
        $alias_1 = "trojan.vkbase" ascii wide nocase
        $alias_2 = "adware.vkbase" ascii wide nocase
        $alias_3 = "spyware.vkbase" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VKBASE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vkbase tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vkbase"
        date = "2026-10-16"
    strings:
        $attrib_str = "vkbase" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vkdj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vkdj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VKDJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vkdj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vkdj"
        date = "2026-10-16"
    strings:
        $fam_name = "vkdj" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VKDJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vkdj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vkdj"
        date = "2026-10-16"
    strings:
        $attrib_str = "vkdj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vkhost (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vkhost
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VKHOST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vkhost (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vkhost"
        date = "2026-10-16"
    strings:
        $fam_name = "vkhost" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VKHOST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vkhost tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vkhost"
        date = "2026-10-16"
    strings:
        $attrib_str = "vkhost" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vkont (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vkont
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VKONT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vkont (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vkont"
        date = "2026-10-16"
    strings:
        $fam_name = "vkont" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VKONT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vkont tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vkont"
        date = "2026-10-16"
    strings:
        $attrib_str = "vkont" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vkontaktedj (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vkontaktedj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VKONTAKTEDJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vkontaktedj (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vkontaktedj"
        date = "2026-10-16"
    strings:
        $fam_name = "vkontaktedj" ascii wide nocase
        $alias_1 = "pua:win32/vkontaktedj" ascii wide nocase
        $alias_2 = "adware:win32/vkontaktedj" ascii wide nocase
        $alias_3 = "program:win32/vkontaktedj" ascii wide nocase
        $alias_4 = "vkontaktedj downloader" ascii wide nocase
        $alias_5 = "win32/vkontaktedj" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VKONTAKTEDJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vkontaktedj tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vkontaktedj"
        date = "2026-10-16"
    strings:
        $attrib_str = "vkontaktedj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vmjfbex4Hpjj (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vmjfbex4hpjj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VMJFBEX4HPJJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vmjfbex4Hpjj (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vmjfbex4hpjj"
        date = "2026-10-16"
    strings:
        $fam_name = "vmjfbex4hpjj" ascii wide nocase
        $alias_1 = "trojan.generic.vmjfbex4hpjj" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VMJFBEX4HPJJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vmjfbex4Hpjj tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vmjfbex4hpjj"
        date = "2026-10-16"
    strings:
        $attrib_str = "vmjfbex4hpjj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vmpbad (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vmpbad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VMPBAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vmpbad (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vmpbad"
        date = "2026-10-16"
    strings:
        $fam_name = "vmpbad" ascii wide nocase
        $alias_1 = "trojan:win32/vmpbad" ascii wide nocase
        $alias_2 = "ransom:win32/vmpbad" ascii wide nocase
        $alias_3 = "trojandownloader:win32/vmpbad" ascii wide nocase
        $alias_4 = "win32/vmpbad" ascii wide nocase
        $alias_5 = "vmpbad ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VMPBAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vmpbad tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vmpbad"
        date = "2026-10-16"
    strings:
        $attrib_str = "vmpbad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vmprotbad (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vmprotbad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VMPROTBAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vmprotbad (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vmprotbad"
        date = "2026-10-16"
    strings:
        $fam_name = "vmprotbad" ascii wide nocase
        $alias_1 = "trojan:win32/vmprotbad" ascii wide nocase
        $alias_2 = "trojan:win32/vmprotect" ascii wide nocase
        $alias_3 = "win32/vmprotbad" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VMPROTBAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vmprotbad tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vmprotbad"
        date = "2026-10-16"
    strings:
        $attrib_str = "vmprotbad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vobfus (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vobfus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VOBFUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vobfus (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vobfus"
        date = "2026-10-16"
    strings:
        $fam_name = "vobfus" ascii wide nocase
        $alias_1 = "win32/vobfus" ascii wide nocase
        $alias_2 = "worm:win32/vobfus" ascii wide nocase
        $alias_3 = "worm_vobfus" ascii wide nocase
        $alias_4 = "beebone worm" ascii wide nocase
        $alias_5 = "vobfus.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VOBFUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vobfus tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vobfus"
        date = "2026-10-16"
    strings:
        $attrib_str = "vobfus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Volt (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/volt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VOLT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Volt (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/volt"
        date = "2026-10-16"
    strings:
        $fam_name = "volt" ascii wide nocase
        $alias_1 = "trojan:win32/volt" ascii wide nocase
        $alias_2 = "trojandownloader:win32/volt" ascii wide nocase
        $alias_3 = "trojan.volt" ascii wide nocase
        $alias_4 = "win32/volt" ascii wide nocase
        $alias_5 = "trojan:win32/volt.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VOLT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Volt tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/volt"
        date = "2026-10-16"
    strings:
        $attrib_str = "volt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vonteera (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vonteera
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VONTEERA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vonteera (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vonteera"
        date = "2026-10-16"
    strings:
        $fam_name = "vonteera" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VONTEERA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vonteera tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vonteera"
        date = "2026-10-16"
    strings:
        $attrib_str = "vonteera" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vools (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vools
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VOOLS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vools (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vools"
        date = "2026-10-16"
    strings:
        $fam_name = "vools" ascii wide nocase
        $alias_1 = "ransom:win32/vools" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.vools" ascii wide nocase
        $alias_3 = "win32/vools" ascii wide nocase
        $alias_4 = "vools ransomware" ascii wide nocase
        $alias_5 = "ransom.vools" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VOOLS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vools tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vools"
        date = "2026-10-16"
    strings:
        $attrib_str = "vools" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vopackage (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vopackage
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VOPACKAGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vopackage (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vopackage"
        date = "2026-10-16"
    strings:
        $fam_name = "vopackage" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VOPACKAGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vopackage tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vopackage"
        date = "2026-10-16"
    strings:
        $attrib_str = "vopackage" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vopak (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vopak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VOPAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vopak (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vopak"
        date = "2026-10-16"
    strings:
        $fam_name = "vopak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VOPAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vopak tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vopak"
        date = "2026-10-16"
    strings:
        $attrib_str = "vopak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vortex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vortex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VORTEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vortex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vortex"
        date = "2026-10-16"
    strings:
        $fam_name = "vortex" ascii wide nocase
        $alias_1 = "trojan-ransom.win32.vortex" ascii wide nocase
        $alias_2 = "ransom.aes-ni" ascii wide nocase
        $alias_3 = "win32/vortex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VORTEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vortex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vortex"
        date = "2026-10-16"
    strings:
        $attrib_str = "vortex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vosteran (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vosteran
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VOSTERAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vosteran (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vosteran"
        date = "2026-10-16"
    strings:
        $fam_name = "vosteran" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VOSTERAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vosteran tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vosteran"
        date = "2026-10-16"
    strings:
        $attrib_str = "vosteran" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Votchsys (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/votchsys
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VOTCHSYS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Votchsys (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/votchsys"
        date = "2026-10-16"
    strings:
        $fam_name = "votchsys" ascii wide nocase
        $alias_1 = "trojan.votchsys" ascii wide nocase
        $alias_2 = "downloader.votchsys" ascii wide nocase
        $alias_3 = "win32/votchsys" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VOTCHSYS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Votchsys tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/votchsys"
        date = "2026-10-16"
    strings:
        $attrib_str = "votchsys" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vprotect (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vprotect
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VPROTECT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vprotect (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vprotect"
        date = "2026-10-16"
    strings:
        $fam_name = "vprotect" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VPROTECT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vprotect tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vprotect"
        date = "2026-10-16"
    strings:
        $attrib_str = "vprotect" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vrbrothers (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vrbrothers
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VRBROTHERS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vrbrothers (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vrbrothers"
        date = "2026-10-16"
    strings:
        $fam_name = "vrbrothers" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VRBROTHERS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vrbrothers tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vrbrothers"
        date = "2026-10-16"
    strings:
        $attrib_str = "vrbrothers" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vstoolbar (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vstoolbar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VSTOOLBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vstoolbar (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vstoolbar"
        date = "2026-10-16"
    strings:
        $fam_name = "vstoolbar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VSTOOLBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vstoolbar tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vstoolbar"
        date = "2026-10-16"
    strings:
        $attrib_str = "vstoolbar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vtflooder (Pua_Tool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vtflooder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VTFLOODER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vtflooder (Pua_Tool)"
        category = "Pua_Tool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vtflooder"
        date = "2026-10-16"
    strings:
        $fam_name = "vtflooder" ascii wide nocase
        $alias_1 = "trojan:win32/vtflooder" ascii wide nocase
        $alias_2 = "tool:win32/vtflooder" ascii wide nocase
        $alias_3 = "spammer:win32/vtflooder" ascii wide nocase
        $alias_4 = "tool.win32.vtflooder" ascii wide nocase
        $alias_5 = "troj/vtflood" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VTFLOODER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vtflooder tradecraft"
        category = "Pua_Tool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vtflooder"
        date = "2026-10-16"
    strings:
        $attrib_str = "vtflooder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vtub (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vtub
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VTUB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vtub (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vtub"
        date = "2026-10-16"
    strings:
        $fam_name = "vtub" ascii wide nocase
        $alias_1 = "worm.vtub" ascii wide nocase
        $alias_2 = "w32/vtub" ascii wide nocase
        $alias_3 = "networm.vtub" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VTUB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vtub tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vtub"
        date = "2026-10-16"
    strings:
        $attrib_str = "vtub" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vucha (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vucha
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VUCHA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vucha (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vucha"
        date = "2026-10-16"
    strings:
        $fam_name = "vucha" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VUCHA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vucha tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vucha"
        date = "2026-10-16"
    strings:
        $attrib_str = "vucha" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Vundo (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vundo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VUNDO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vundo (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vundo"
        date = "2026-10-16"
    strings:
        $fam_name = "vundo" ascii wide nocase
        $alias_1 = "trojan:win32/vundo" ascii wide nocase
        $alias_2 = "trojan.vundo" ascii wide nocase
        $alias_3 = "win32.virtumonde" ascii wide nocase
        $alias_4 = "virtumonde" ascii wide nocase
        $alias_5 = "trojan.win32.vundo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VUNDO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vundo tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vundo"
        date = "2026-10-16"
    strings:
        $attrib_str = "vundo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Vxidl (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vxidl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VXIDL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vxidl (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vxidl"
        date = "2026-10-16"
    strings:
        $fam_name = "vxidl" ascii wide nocase
        $alias_1 = "vbs.vxidl" ascii wide nocase
        $alias_2 = "virus.vbs.vxidl" ascii wide nocase
        $alias_3 = "worm.vbs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VXIDL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vxidl tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vxidl"
        date = "2026-10-16"
    strings:
        $attrib_str = "vxidl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Vz2Au4Dpceii (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/vz2au4dpceii
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_VZ2AU4DPCEII_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Vz2Au4Dpceii (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vz2au4dpceii"
        date = "2026-10-16"
    strings:
        $fam_name = "vz2au4dpceii" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_VZ2AU4DPCEII_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Vz2Au4Dpceii tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/vz2au4dpceii"
        date = "2026-10-16"
    strings:
        $attrib_str = "vz2au4dpceii" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for W10Tweak (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/w10tweak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_W10TWEAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for W10Tweak (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/w10tweak"
        date = "2026-10-16"
    strings:
        $fam_name = "w10tweak" ascii wide nocase
        $alias_1 = "hacktool.w10tweak" ascii wide nocase
        $alias_2 = "riskware.win10tweaker" ascii wide nocase
        $alias_3 = "tool.win32.w10tweak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_W10TWEAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for W10Tweak tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/w10tweak"
        date = "2026-10-16"
    strings:
        $attrib_str = "w10tweak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wabot (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wabot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WABOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wabot (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wabot"
        date = "2026-10-16"
    strings:
        $fam_name = "wabot" ascii wide nocase
        $alias_1 = "wabot" ascii wide nocase
        $alias_2 = "trojan:win32/wabot" ascii wide nocase
        $alias_3 = "worm.win32.wabot" ascii wide nocase
        $alias_4 = "win32/wabot" ascii wide nocase
        $alias_5 = "wabot irc bot" ascii wide nocase
        $alias_6 = "backdoor.wabot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WABOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wabot tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wabot"
        date = "2026-10-16"
    strings:
        $attrib_str = "wabot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Wadhrama (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wadhrama
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WADHRAMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wadhrama (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wadhrama"
        date = "2026-10-16"
    strings:
        $fam_name = "wadhrama" ascii wide nocase
        $alias_1 = "ransomware.wadhrama" ascii wide nocase
        $alias_2 = "win32/wadhrama" ascii wide nocase
        $alias_3 = "trojan-ransom.wadhrama" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WADHRAMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wadhrama tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wadhrama"
        date = "2026-10-16"
    strings:
        $attrib_str = "wadhrama" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wajam (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wajam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WAJAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wajam (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wajam"
        date = "2026-10-16"
    strings:
        $fam_name = "wajam" ascii wide nocase
        $alias_1 = "adware:win32/wajam" ascii wide nocase
        $alias_2 = "adware.wajam" ascii wide nocase
        $alias_3 = "searchprotect" ascii wide nocase
        $alias_4 = "wajam internet enhancer" ascii wide nocase
        $alias_5 = "pup.optional.wajam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WAJAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wajam tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wajam"
        date = "2026-10-16"
    strings:
        $attrib_str = "wajam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wakme (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wakme
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WAKME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wakme (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wakme"
        date = "2026-10-16"
    strings:
        $fam_name = "wakme" ascii wide nocase
        $alias_1 = "trojandownloader:win32/wakme" ascii wide nocase
        $alias_2 = "trojan:win32/wakme" ascii wide nocase
        $alias_3 = "troj_wakme.a" ascii wide nocase
        $alias_4 = "win32/wakme" ascii wide nocase
        $alias_5 = "trojan.wakme" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WAKME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wakme tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wakme"
        date = "2026-10-16"
    strings:
        $attrib_str = "wakme" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Waldek (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/waldek
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WALDEK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Waldek (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/waldek"
        date = "2026-10-16"
    strings:
        $fam_name = "waldek" ascii wide nocase
        $alias_1 = "trojan.win32.waldek" ascii wide nocase
        $alias_2 = "trojan:win32/waldek!msr" ascii wide nocase
        $alias_3 = "win32/waldek" ascii wide nocase
        $alias_4 = "trojan:win32/waldek" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WALDEK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Waldek tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/waldek"
        date = "2026-10-16"
    strings:
        $attrib_str = "waldek" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Walerlop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/walerlop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WALERLOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Walerlop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/walerlop"
        date = "2026-10-16"
    strings:
        $fam_name = "walerlop" ascii wide nocase
        $alias_1 = "trojan.walerlop" ascii wide nocase
        $alias_2 = "downloader.walerlop" ascii wide nocase
        $alias_3 = "win32/walerlop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WALERLOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Walerlop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/walerlop"
        date = "2026-10-16"
    strings:
        $attrib_str = "walerlop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wannacry (Ransomware_Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wannacry
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WANNACRY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wannacry (Ransomware_Worm)"
        category = "Ransomware_Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wannacry"
        date = "2026-10-16"
    strings:
        $fam_name = "wannacry" ascii wide nocase
        $alias_1 = "wannacry" ascii wide nocase
        $alias_2 = "wanacrypt0r" ascii wide nocase
        $alias_3 = "wcry" ascii wide nocase
        $alias_4 = "wannacrypt" ascii wide nocase
        $alias_5 = "wanacrypt0r 2.0" ascii wide nocase
        $alias_6 = "ransom.wannacry" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WANNACRY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wannacry tradecraft"
        category = "Ransomware_Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wannacry"
        date = "2026-10-16"
    strings:
        $attrib_str = "wannacry" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wansrog (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wansrog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WANSROG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wansrog (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wansrog"
        date = "2026-10-16"
    strings:
        $fam_name = "wansrog" ascii wide nocase
        $alias_1 = "trojan.wansrog" ascii wide nocase
        $alias_2 = "downloader.wansrog" ascii wide nocase
        $alias_3 = "win32/wansrog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WANSROG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wansrog tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wansrog"
        date = "2026-10-16"
    strings:
        $attrib_str = "wansrog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wapomi (Worm_Banker)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wapomi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WAPOMI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wapomi (Worm_Banker)"
        category = "Worm_Banker"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wapomi"
        date = "2026-10-16"
    strings:
        $fam_name = "wapomi" ascii wide nocase
        $alias_1 = "wapomi" ascii wide nocase
        $alias_2 = "virus.wapomi" ascii wide nocase
        $alias_3 = "w32.wapomi" ascii wide nocase
        $alias_4 = "pe_wapomi" ascii wide nocase
        $alias_5 = "otwycal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WAPOMI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wapomi tradecraft"
        category = "Worm_Banker"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wapomi"
        date = "2026-10-16"
    strings:
        $attrib_str = "wapomi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Warezov (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/warezov
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WAREZOV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Warezov (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/warezov"
        date = "2026-10-16"
    strings:
        $fam_name = "warezov" ascii wide nocase
        $alias_1 = "worm:win32/warezov" ascii wide nocase
        $alias_2 = "email-worm.win32.warezov" ascii wide nocase
        $alias_3 = "w32/warezov" ascii wide nocase
        $alias_4 = "stration" ascii wide nocase
        $alias_5 = "worm.win32.stration" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WAREZOV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Warezov tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/warezov"
        date = "2026-10-16"
    strings:
        $attrib_str = "warezov" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wavipeg (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wavipeg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WAVIPEG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wavipeg (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wavipeg"
        date = "2026-10-16"
    strings:
        $fam_name = "wavipeg" ascii wide nocase
        $alias_1 = "trojan.wavipeg" ascii wide nocase
        $alias_2 = "downloader.wavipeg" ascii wide nocase
        $alias_3 = "win32/wavipeg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WAVIPEG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wavipeg tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wavipeg"
        date = "2026-10-16"
    strings:
        $attrib_str = "wavipeg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wdfload (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wdfload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WDFLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wdfload (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wdfload"
        date = "2026-10-16"
    strings:
        $fam_name = "wdfload" ascii wide nocase
        $alias_1 = "trojan:win32/wdfload" ascii wide nocase
        $alias_2 = "rootkit:win32/wdfload" ascii wide nocase
        $alias_3 = "trojan.wdfload" ascii wide nocase
        $alias_4 = "win32/wdfload.rootkit" ascii wide nocase
        $alias_5 = "kernel.wdfload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WDFLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wdfload tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wdfload"
        date = "2026-10-16"
    strings:
        $attrib_str = "wdfload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wdjiange (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wdjiange
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WDJIANGE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wdjiange (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wdjiange"
        date = "2026-10-16"
    strings:
        $fam_name = "wdjiange" ascii wide nocase
        $alias_1 = "ransom:win32/wdjiange" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.wdjiange" ascii wide nocase
        $alias_3 = "win32/wdjiange" ascii wide nocase
        $alias_4 = "ransom.wdjiange" ascii wide nocase
        $alias_5 = "ransom:win32/wdjiange.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WDJIANGE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wdjiange tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wdjiange"
        date = "2026-10-16"
    strings:
        $attrib_str = "wdjiange" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Webalta (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webalta
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBALTA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webalta (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webalta"
        date = "2026-10-16"
    strings:
        $fam_name = "webalta" ascii wide nocase
        $alias_1 = "browsermodifier:win32/webalta" ascii wide nocase
        $alias_2 = "adware.webalta" ascii wide nocase
        $alias_3 = "trojan.win32.webalta" ascii wide nocase
        $alias_4 = "win32/webalta" ascii wide nocase
        $alias_5 = "adware:win32/webalta" ascii wide nocase
        $alias_6 = "browsermodifier:win32/webalta.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBALTA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webalta tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webalta"
        date = "2026-10-16"
    strings:
        $attrib_str = "webalta" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Webaltatoolbar (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webaltatoolbar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBALTATOOLBAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webaltatoolbar (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webaltatoolbar"
        date = "2026-10-16"
    strings:
        $fam_name = "webaltatoolbar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBALTATOOLBAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webaltatoolbar tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webaltatoolbar"
        date = "2026-10-16"
    strings:
        $attrib_str = "webaltatoolbar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Webbrowserpassview (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webbrowserpassview
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBBROWSERPASSVIEW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webbrowserpassview (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webbrowserpassview"
        date = "2026-10-16"
    strings:
        $fam_name = "webbrowserpassview" ascii wide nocase
        $alias_1 = "hacktool.webbrowserpassview" ascii wide nocase
        $alias_2 = "riskware.passwordrevealer" ascii wide nocase
        $alias_3 = "win32/webbrowserpassview" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBBROWSERPASSVIEW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webbrowserpassview tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webbrowserpassview"
        date = "2026-10-16"
    strings:
        $attrib_str = "webbrowserpassview" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Webcompanion (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webcompanion
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBCOMPANION_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webcompanion (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webcompanion"
        date = "2026-10-16"
    strings:
        $fam_name = "webcompanion" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBCOMPANION_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webcompanion tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webcompanion"
        date = "2026-10-16"
    strings:
        $attrib_str = "webcompanion" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Webdevaz (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webdevaz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBDEVAZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webdevaz (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webdevaz"
        date = "2026-10-16"
    strings:
        $fam_name = "webdevaz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBDEVAZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webdevaz tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webdevaz"
        date = "2026-10-16"
    strings:
        $attrib_str = "webdevaz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Webdial (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webdial
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBDIAL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webdial (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webdial"
        date = "2026-10-16"
    strings:
        $fam_name = "webdial" ascii wide nocase
        $alias_1 = "dialer.webdial" ascii wide nocase
        $alias_2 = "trojan.dialer" ascii wide nocase
        $alias_3 = "win32/dialer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBDIAL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webdial tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webdial"
        date = "2026-10-16"
    strings:
        $attrib_str = "webdial" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Webdialer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webdialer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBDIALER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webdialer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webdialer"
        date = "2026-10-16"
    strings:
        $fam_name = "webdialer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBDIALER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webdialer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webdialer"
        date = "2026-10-16"
    strings:
        $attrib_str = "webdialer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Webdiscover (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webdiscover
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBDISCOVER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webdiscover (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webdiscover"
        date = "2026-10-16"
    strings:
        $fam_name = "webdiscover" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBDISCOVER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webdiscover tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webdiscover"
        date = "2026-10-16"
    strings:
        $attrib_str = "webdiscover" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Webdown (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webdown
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBDOWN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webdown (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webdown"
        date = "2026-10-16"
    strings:
        $fam_name = "webdown" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBDOWN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webdown tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webdown"
        date = "2026-10-16"
    strings:
        $attrib_str = "webdown" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Webhat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webhat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBHAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webhat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webhat"
        date = "2026-10-16"
    strings:
        $fam_name = "webhat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBHAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webhat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webhat"
        date = "2026-10-16"
    strings:
        $attrib_str = "webhat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Webisida (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webisida
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBISIDA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webisida (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webisida"
        date = "2026-10-16"
    strings:
        $fam_name = "webisida" ascii wide nocase
        $alias_1 = "riskware.webisida" ascii wide nocase
        $alias_2 = "pup.trafficexchange" ascii wide nocase
        $alias_3 = "clicker.webisida" ascii wide nocase
        $alias_4 = "tool.autosurf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBISIDA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webisida tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webisida"
        date = "2026-10-16"
    strings:
        $attrib_str = "webisida" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Webprefix (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webprefix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBPREFIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webprefix (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webprefix"
        date = "2026-10-16"
    strings:
        $fam_name = "webprefix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBPREFIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webprefix tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webprefix"
        date = "2026-10-16"
    strings:
        $attrib_str = "webprefix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Websearch (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/websearch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBSEARCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Websearch (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/websearch"
        date = "2026-10-16"
    strings:
        $fam_name = "websearch" ascii wide nocase
        $alias_1 = "browsermodifier:win32/websearch" ascii wide nocase
        $alias_2 = "adware:win32/websearch" ascii wide nocase
        $alias_3 = "pua:win32/websearch" ascii wide nocase
        $alias_4 = "win32/websearch" ascii wide nocase
        $alias_5 = "websearch hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBSEARCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Websearch tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/websearch"
        date = "2026-10-16"
    strings:
        $attrib_str = "websearch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Webwatcher (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/webwatcher
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEBWATCHER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Webwatcher (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webwatcher"
        date = "2026-10-16"
    strings:
        $fam_name = "webwatcher" ascii wide nocase
        $alias_1 = "spyware:win32/webwatcher" ascii wide nocase
        $alias_2 = "monitoringtool:win32/webwatcher" ascii wide nocase
        $alias_3 = "pua:win32/webwatcher" ascii wide nocase
        $alias_4 = "webwatcher spyware" ascii wide nocase
        $alias_5 = "win32/webwatcher" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEBWATCHER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Webwatcher tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/webwatcher"
        date = "2026-10-16"
    strings:
        $attrib_str = "webwatcher" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wecod (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wecod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WECOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wecod (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wecod"
        date = "2026-10-16"
    strings:
        $fam_name = "wecod" ascii wide nocase
        $alias_1 = "trojan:win32/wecod" ascii wide nocase
        $alias_2 = "trojan.win32.wecod" ascii wide nocase
        $alias_3 = "win32/wecod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WECOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wecod tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wecod"
        date = "2026-10-16"
    strings:
        $attrib_str = "wecod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Weenloc (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/weenloc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEENLOC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Weenloc (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/weenloc"
        date = "2026-10-16"
    strings:
        $fam_name = "weenloc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEENLOC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Weenloc tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/weenloc"
        date = "2026-10-16"
    strings:
        $attrib_str = "weenloc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Weiduan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/weiduan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEIDUAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Weiduan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/weiduan"
        date = "2026-10-16"
    strings:
        $fam_name = "weiduan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEIDUAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Weiduan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/weiduan"
        date = "2026-10-16"
    strings:
        $attrib_str = "weiduan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wellmess (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wellmess
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WELLMESS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wellmess (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wellmess"
        date = "2026-10-16"
    strings:
        $fam_name = "wellmess" ascii wide nocase
        $alias_1 = "apt.wellmess" ascii wide nocase
        $alias_2 = "backdoor.wellmess" ascii wide nocase
        $alias_3 = "linux/wellmess" ascii wide nocase
        $alias_4 = "win32/wellmess" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WELLMESS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wellmess tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wellmess"
        date = "2026-10-16"
    strings:
        $attrib_str = "wellmess" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wemosis (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wemosis
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEMOSIS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wemosis (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wemosis"
        date = "2026-10-16"
    strings:
        $fam_name = "wemosis" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEMOSIS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wemosis tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wemosis"
        date = "2026-10-16"
    strings:
        $attrib_str = "wemosis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wenper (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wenper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WENPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wenper (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wenper"
        date = "2026-10-16"
    strings:
        $fam_name = "wenper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WENPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wenper tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wenper"
        date = "2026-10-16"
    strings:
        $attrib_str = "wenper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Werly (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/werly
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WERLY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Werly (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/werly"
        date = "2026-10-16"
    strings:
        $fam_name = "werly" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WERLY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Werly tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/werly"
        date = "2026-10-16"
    strings:
        $attrib_str = "werly" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Werpoapt (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/werpoapt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WERPOAPT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Werpoapt (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/werpoapt"
        date = "2026-10-16"
    strings:
        $fam_name = "werpoapt" ascii wide nocase
        $alias_1 = "apt.werpo" ascii wide nocase
        $alias_2 = "trojan.werpoapt" ascii wide nocase
        $alias_3 = "win32/werpo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WERPOAPT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Werpoapt tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/werpoapt"
        date = "2026-10-16"
    strings:
        $attrib_str = "werpoapt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Wews (Exploit)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wews
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WEWS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wews (Exploit)"
        category = "Exploit"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wews"
        date = "2026-10-16"
    strings:
        $fam_name = "wews" ascii wide nocase
        $alias_1 = "exploit:html/wews" ascii wide nocase
        $alias_2 = "exploit.html.wews" ascii wide nocase
        $alias_3 = "trojan-downloader.html.wews" ascii wide nocase
        $alias_4 = "html/wews" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WEWS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wews tradecraft"
        category = "Exploit"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wews"
        date = "2026-10-16"
    strings:
        $attrib_str = "wews" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wfpdisabler (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wfpdisabler
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WFPDISABLER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wfpdisabler (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wfpdisabler"
        date = "2026-10-16"
    strings:
        $fam_name = "wfpdisabler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WFPDISABLER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wfpdisabler tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wfpdisabler"
        date = "2026-10-16"
    strings:
        $attrib_str = "wfpdisabler" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Wgapatch (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wgapatch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WGAPATCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wgapatch (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wgapatch"
        date = "2026-10-16"
    strings:
        $fam_name = "wgapatch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WGAPATCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wgapatch tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wgapatch"
        date = "2026-10-16"
    strings:
        $attrib_str = "wgapatch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Whenu (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/whenu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WHENU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Whenu (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/whenu"
        date = "2026-10-16"
    strings:
        $fam_name = "whenu" ascii wide nocase
        $alias_1 = "adware.whenu" ascii wide nocase
        $alias_2 = "pup.savenow" ascii wide nocase
        $alias_3 = "adware.whenusave" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WHENU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Whenu tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/whenu"
        date = "2026-10-16"
    strings:
        $attrib_str = "whenu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Whimoo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/whimoo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WHIMOO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Whimoo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/whimoo"
        date = "2026-10-16"
    strings:
        $fam_name = "whimoo" ascii wide nocase
        $alias_1 = "adware.whimoo" ascii wide nocase
        $alias_2 = "pup.whimoo" ascii wide nocase
        $alias_3 = "browsermodifier.whimoo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WHIMOO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Whimoo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/whimoo"
        date = "2026-10-16"
    strings:
        $attrib_str = "whimoo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Whiteclick (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/whiteclick
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WHITECLICK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Whiteclick (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/whiteclick"
        date = "2026-10-16"
    strings:
        $fam_name = "whiteclick" ascii wide nocase
        $alias_1 = "adware.whiteclick" ascii wide nocase
        $alias_2 = "pup.whiteclick" ascii wide nocase
        $alias_3 = "trojan.clicker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WHITECLICK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Whiteclick tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/whiteclick"
        date = "2026-10-16"
    strings:
        $attrib_str = "whiteclick" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Whiteice (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/whiteice
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WHITEICE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Whiteice (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/whiteice"
        date = "2026-10-16"
    strings:
        $fam_name = "whiteice" ascii wide nocase
        $alias_1 = "downloader.whiteice" ascii wide nocase
        $alias_2 = "trojan.whiteice" ascii wide nocase
        $alias_3 = "win32/whiteice" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WHITEICE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Whiteice tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/whiteice"
        date = "2026-10-16"
    strings:
        $attrib_str = "whiteice" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wi0Abyrjybki (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wi0abyrjybki
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WI0ABYRJYBKI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wi0Abyrjybki (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wi0abyrjybki"
        date = "2026-10-16"
    strings:
        $fam_name = "wi0abyrjybki" ascii wide nocase
        $alias_1 = "trojan.generic.wi0abyrjybki" ascii wide nocase
        $alias_2 = "malware.obfuscated.dga" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WI0ABYRJYBKI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wi0Abyrjybki tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wi0abyrjybki"
        date = "2026-10-16"
    strings:
        $attrib_str = "wi0abyrjybki" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Widdit (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/widdit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WIDDIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Widdit (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/widdit"
        date = "2026-10-16"
    strings:
        $fam_name = "widdit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WIDDIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Widdit tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/widdit"
        date = "2026-10-16"
    strings:
        $attrib_str = "widdit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Widgi (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/widgi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WIDGI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Widgi (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/widgi"
        date = "2026-10-16"
    strings:
        $fam_name = "widgi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WIDGI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Widgi tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/widgi"
        date = "2026-10-16"
    strings:
        $attrib_str = "widgi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wigon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wigon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WIGON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wigon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wigon"
        date = "2026-10-16"
    strings:
        $fam_name = "wigon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WIGON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wigon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wigon"
        date = "2026-10-16"
    strings:
        $attrib_str = "wigon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wiliky (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wiliky
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WILIKY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wiliky (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wiliky"
        date = "2026-10-16"
    strings:
        $fam_name = "wiliky" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WILIKY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wiliky tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wiliky"
        date = "2026-10-16"
    strings:
        $attrib_str = "wiliky" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Winactivator (Pua_Tool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winactivator
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINACTIVATOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winactivator (Pua_Tool)"
        category = "Pua_Tool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winactivator"
        date = "2026-10-16"
    strings:
        $fam_name = "winactivator" ascii wide nocase
        $alias_1 = "hacktool:win32/autokms" ascii wide nocase
        $alias_2 = "hacktool:win32/winactivator" ascii wide nocase
        $alias_3 = "pua:win32/kmspico" ascii wide nocase
        $alias_4 = "win32/autokms.hacktool" ascii wide nocase
        $alias_5 = "riskware.winactivator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINACTIVATOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winactivator tradecraft"
        category = "Pua_Tool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winactivator"
        date = "2026-10-16"
    strings:
        $attrib_str = "winactivator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Windang (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/windang
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINDANG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Windang (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/windang"
        date = "2026-10-16"
    strings:
        $fam_name = "windang" ascii wide nocase
        $alias_1 = "trojan.windang" ascii wide nocase
        $alias_2 = "botnet.windang" ascii wide nocase
        $alias_3 = "win32/windang" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINDANG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Windang tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/windang"
        date = "2026-10-16"
    strings:
        $attrib_str = "windang" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Windapp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/windapp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINDAPP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Windapp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/windapp"
        date = "2026-10-16"
    strings:
        $fam_name = "windapp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINDAPP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Windapp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/windapp"
        date = "2026-10-16"
    strings:
        $attrib_str = "windapp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Winemm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winemm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINEMM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winemm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winemm"
        date = "2026-10-16"
    strings:
        $fam_name = "winemm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINEMM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winemm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winemm"
        date = "2026-10-16"
    strings:
        $attrib_str = "winemm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Winevar (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winevar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINEVAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winevar (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winevar"
        date = "2026-10-16"
    strings:
        $fam_name = "winevar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINEVAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winevar tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winevar"
        date = "2026-10-16"
    strings:
        $attrib_str = "winevar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Winexe (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winexe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINEXE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winexe (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winexe"
        date = "2026-10-16"
    strings:
        $fam_name = "winexe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINEXE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winexe tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winexe"
        date = "2026-10-16"
    strings:
        $attrib_str = "winexe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Winexec (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winexec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINEXEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winexec (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winexec"
        date = "2026-10-16"
    strings:
        $fam_name = "winexec" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINEXEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winexec tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winexec"
        date = "2026-10-16"
    strings:
        $attrib_str = "winexec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Winiga (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winiga
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINIGA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winiga (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winiga"
        date = "2026-10-16"
    strings:
        $fam_name = "winiga" ascii wide nocase
        $alias_1 = "trojan.winiga" ascii wide nocase
        $alias_2 = "downloader.winiga" ascii wide nocase
        $alias_3 = "win32/winiga" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINIGA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winiga tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winiga"
        date = "2026-10-16"
    strings:
        $attrib_str = "winiga" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Winload (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winload
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINLOAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winload (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winload"
        date = "2026-10-16"
    strings:
        $fam_name = "winload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINLOAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winload tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winload"
        date = "2026-10-16"
    strings:
        $attrib_str = "winload" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Winloadsda (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winloadsda
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINLOADSDA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winloadsda (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winloadsda"
        date = "2026-10-16"
    strings:
        $fam_name = "winloadsda" ascii wide nocase
        $alias_1 = "trojandownloader:win32/winloadsda" ascii wide nocase
        $alias_2 = "trojan:win32/winloadsda" ascii wide nocase
        $alias_3 = "win32/winloadsda" ascii wide nocase
        $alias_4 = "winloadsda loader" ascii wide nocase
        $alias_5 = "winloadsda trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINLOADSDA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winloadsda tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winloadsda"
        date = "2026-10-16"
    strings:
        $attrib_str = "winloadsda" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Winlock (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winlock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINLOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winlock (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winlock"
        date = "2026-10-16"
    strings:
        $fam_name = "winlock" ascii wide nocase
        $alias_1 = "ransom:win32/winlock" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.winlock" ascii wide nocase
        $alias_3 = "win32/winlock" ascii wide nocase
        $alias_4 = "ransom.winlock" ascii wide nocase
        $alias_5 = "ransom:win32/winlock.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINLOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winlock tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winlock"
        date = "2026-10-16"
    strings:
        $attrib_str = "winlock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Winner (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winner
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINNER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winner (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winner"
        date = "2026-10-16"
    strings:
        $fam_name = "winner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINNER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winner tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winner"
        date = "2026-10-16"
    strings:
        $attrib_str = "winner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Winnti (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winnti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINNTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winnti (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winnti"
        date = "2026-10-16"
    strings:
        $fam_name = "winnti" ascii wide nocase
        $alias_1 = "winnti" ascii wide nocase
        $alias_2 = "winnti backdoor" ascii wide nocase
        $alias_3 = "backdoor.winnti" ascii wide nocase
        $alias_4 = "trojan:win32/winnti" ascii wide nocase
        $alias_5 = "winnti trojan" ascii wide nocase
        $alias_6 = "apt41 core backdoor" ascii wide nocase
        $alias_7 = "winnti group malware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINNTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winnti tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winnti"
        date = "2026-10-16"
    strings:
        $attrib_str = "winnti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Winreg (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winreg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINREG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winreg (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winreg"
        date = "2026-10-16"
    strings:
        $fam_name = "winreg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINREG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winreg tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winreg"
        date = "2026-10-16"
    strings:
        $attrib_str = "winreg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Winsecsrv (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winsecsrv
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINSECSRV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winsecsrv (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winsecsrv"
        date = "2026-10-16"
    strings:
        $fam_name = "winsecsrv" ascii wide nocase
        $alias_1 = "trojan:win32/winsecsrv" ascii wide nocase
        $alias_2 = "trojan.win32.winsecsrv" ascii wide nocase
        $alias_3 = "trojandownloader:win32/winsecsrv" ascii wide nocase
        $alias_4 = "win32/winsecsrv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINSECSRV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winsecsrv tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winsecsrv"
        date = "2026-10-16"
    strings:
        $attrib_str = "winsecsrv" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Winshell (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winshell
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINSHELL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winshell (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winshell"
        date = "2026-10-16"
    strings:
        $fam_name = "winshell" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINSHELL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winshell tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winshell"
        date = "2026-10-16"
    strings:
        $attrib_str = "winshell" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Winshow (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winshow
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINSHOW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winshow (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winshow"
        date = "2026-10-16"
    strings:
        $fam_name = "winshow" ascii wide nocase
        $alias_1 = "adware.winshow" ascii wide nocase
        $alias_2 = "browserhijacker.winshow" ascii wide nocase
        $alias_3 = "pup.winshow" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINSHOW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winshow tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winshow"
        date = "2026-10-16"
    strings:
        $attrib_str = "winshow" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Winspeedup (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winspeedup
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINSPEEDUP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winspeedup (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winspeedup"
        date = "2026-10-16"
    strings:
        $fam_name = "winspeedup" ascii wide nocase
        $alias_1 = "rogue.winspeedup" ascii wide nocase
        $alias_2 = "pup.systemoptimizer" ascii wide nocase
        $alias_3 = "scareware.speedup" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINSPEEDUP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winspeedup tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winspeedup"
        date = "2026-10-16"
    strings:
        $attrib_str = "winspeedup" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Winspy (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winspy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINSPY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winspy (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winspy"
        date = "2026-10-16"
    strings:
        $fam_name = "winspy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINSPY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winspy tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winspy"
        date = "2026-10-16"
    strings:
        $attrib_str = "winspy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wintaskad (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wintaskad
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINTASKAD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wintaskad (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wintaskad"
        date = "2026-10-16"
    strings:
        $fam_name = "wintaskad" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINTASKAD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wintaskad tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wintaskad"
        date = "2026-10-16"
    strings:
        $attrib_str = "wintaskad" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wintrim (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wintrim
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINTRIM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wintrim (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wintrim"
        date = "2026-10-16"
    strings:
        $fam_name = "wintrim" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINTRIM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wintrim tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wintrim"
        date = "2026-10-16"
    strings:
        $attrib_str = "wintrim" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Winvnc (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winvnc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINVNC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winvnc (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winvnc"
        date = "2026-10-16"
    strings:
        $fam_name = "winvnc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINVNC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winvnc tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winvnc"
        date = "2026-10-16"
    strings:
        $attrib_str = "winvnc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Winwebsec (Rogueware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winwebsec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINWEBSEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winwebsec (Rogueware)"
        category = "Rogueware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winwebsec"
        date = "2026-10-16"
    strings:
        $fam_name = "winwebsec" ascii wide nocase
        $alias_1 = "rogue:win32/winwebsec" ascii wide nocase
        $alias_2 = "trojan:win32/winwebsec" ascii wide nocase
        $alias_3 = "win32/winwebsec" ascii wide nocase
        $alias_4 = "smart protection 2012" ascii wide nocase
        $alias_5 = "system progressive protection" ascii wide nocase
        $alias_6 = "system security rogue" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINWEBSEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winwebsec tradecraft"
        category = "Rogueware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winwebsec"
        date = "2026-10-16"
    strings:
        $attrib_str = "winwebsec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Winwrapper (Pua_Tool)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/winwrapper
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WINWRAPPER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Winwrapper (Pua_Tool)"
        category = "Pua_Tool"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winwrapper"
        date = "2026-10-16"
    strings:
        $fam_name = "winwrapper" ascii wide nocase
        $alias_1 = "pua:win32/winwrapper" ascii wide nocase
        $alias_2 = "adware.win32.winwrapper" ascii wide nocase
        $alias_3 = "trojan.win32.winwrapper" ascii wide nocase
        $alias_4 = "winwrapper.installer" ascii wide nocase
        $alias_5 = "win32/winwrapper.bundler" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WINWRAPPER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Winwrapper tradecraft"
        category = "Pua_Tool"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/winwrapper"
        date = "2026-10-16"
    strings:
        $attrib_str = "winwrapper" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wirelessnetview (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wirelessnetview
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WIRELESSNETVIEW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wirelessnetview (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wirelessnetview"
        date = "2026-10-16"
    strings:
        $fam_name = "wirelessnetview" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WIRELESSNETVIEW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wirelessnetview tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wirelessnetview"
        date = "2026-10-16"
    strings:
        $attrib_str = "wirelessnetview" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Wirzemro (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wirzemro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WIRZEMRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wirzemro (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wirzemro"
        date = "2026-10-16"
    strings:
        $fam_name = "wirzemro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WIRZEMRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wirzemro tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wirzemro"
        date = "2026-10-16"
    strings:
        $attrib_str = "wirzemro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wisbipuf (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wisbipuf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WISBIPUF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wisbipuf (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wisbipuf"
        date = "2026-10-16"
    strings:
        $fam_name = "wisbipuf" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.wisbipuf" ascii wide nocase
        $alias_3 = "heur.wisbipuf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WISBIPUF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wisbipuf tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wisbipuf"
        date = "2026-10-16"
    strings:
        $attrib_str = "wisbipuf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Wisesystemmechanic (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wisesystemmechanic
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WISESYSTEMMECHANIC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wisesystemmechanic (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wisesystemmechanic"
        date = "2026-10-16"
    strings:
        $fam_name = "wisesystemmechanic" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WISESYSTEMMECHANIC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wisesystemmechanic tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wisesystemmechanic"
        date = "2026-10-16"
    strings:
        $attrib_str = "wisesystemmechanic" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wizrem (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wizrem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WIZREM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wizrem (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wizrem"
        date = "2026-10-16"
    strings:
        $fam_name = "wizrem" ascii wide nocase
        $alias_1 = "softwarebundler:msil/wizrem" ascii wide nocase
        $alias_2 = "trojandownloader:win32/wizrem" ascii wide nocase
        $alias_3 = "trojan:win32/wizrem" ascii wide nocase
        $alias_4 = "msil/wizrem" ascii wide nocase
        $alias_5 = "softwarebundler.wizrem" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WIZREM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wizrem tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wizrem"
        date = "2026-10-16"
    strings:
        $attrib_str = "wizrem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Wizzmonetize (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wizzmonetize
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WIZZMONETIZE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wizzmonetize (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wizzmonetize"
        date = "2026-10-16"
    strings:
        $fam_name = "wizzmonetize" ascii wide nocase
        $alias_1 = "adware:win32/wizzmonetize" ascii wide nocase
        $alias_2 = "pua:win32/wizzmonetize" ascii wide nocase
        $alias_3 = "adware.monetizeinstaller" ascii wide nocase
        $alias_4 = "win32/wizzmonetize.adware" ascii wide nocase
        $alias_5 = "wizzcaster.adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WIZZMONETIZE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wizzmonetize tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wizzmonetize"
        date = "2026-10-16"
    strings:
        $attrib_str = "wizzmonetize" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wlock (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wlock
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WLOCK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wlock (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wlock"
        date = "2026-10-16"
    strings:
        $fam_name = "wlock" ascii wide nocase
        $alias_1 = "ransomware.wlock" ascii wide nocase
        $alias_2 = "trojan.ransom.wlock" ascii wide nocase
        $alias_3 = "winlock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WLOCK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wlock tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wlock"
        date = "2026-10-16"
    strings:
        $attrib_str = "wlock" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wmfap (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wmfap
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WMFAP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wmfap (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wmfap"
        date = "2026-10-16"
    strings:
        $fam_name = "wmfap" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WMFAP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wmfap tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wmfap"
        date = "2026-10-16"
    strings:
        $attrib_str = "wmfap" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wmqarhe5P8Fbt (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wmqarhe5p8fbt
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WMQARHE5P8FBT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wmqarhe5P8Fbt (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wmqarhe5p8fbt"
        date = "2026-10-16"
    strings:
        $fam_name = "wmqarhe5p8fbt" ascii wide nocase
        $alias_1 = "trojan.generic.wmqarhe5p8fbt" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WMQARHE5P8FBT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wmqarhe5P8Fbt tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wmqarhe5p8fbt"
        date = "2026-10-16"
    strings:
        $attrib_str = "wmqarhe5p8fbt" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wombat (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wombat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WOMBAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wombat (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wombat"
        date = "2026-10-16"
    strings:
        $fam_name = "wombat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WOMBAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wombat tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wombat"
        date = "2026-10-16"
    strings:
        $attrib_str = "wombat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Woool (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/woool
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WOOOL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Woool (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/woool"
        date = "2026-10-16"
    strings:
        $fam_name = "woool" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WOOOL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Woool tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/woool"
        date = "2026-10-16"
    strings:
        $attrib_str = "woool" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Wootbot (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wootbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WOOTBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wootbot (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wootbot"
        date = "2026-10-16"
    strings:
        $fam_name = "wootbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WOOTBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wootbot tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wootbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "wootbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Woozlist (Browser_Modifier)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/woozlist
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WOOZLIST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Woozlist (Browser_Modifier)"
        category = "Browser_Modifier"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/woozlist"
        date = "2026-10-16"
    strings:
        $fam_name = "woozlist" ascii wide nocase
        $alias_1 = "browsermodifier:win32/woozlist" ascii wide nocase
        $alias_2 = "adware:win32/woozlist" ascii wide nocase
        $alias_3 = "pua:win32/woozlist" ascii wide nocase
        $alias_4 = "woozlist toolbar" ascii wide nocase
        $alias_5 = "win32/woozlist" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WOOZLIST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Woozlist tradecraft"
        category = "Browser_Modifier"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/woozlist"
        date = "2026-10-16"
    strings:
        $attrib_str = "woozlist" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Woripecs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/woripecs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WORIPECS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Woripecs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/woripecs"
        date = "2026-10-16"
    strings:
        $fam_name = "woripecs" ascii wide nocase
        $alias_1 = "trojan.woripecs" ascii wide nocase
        $alias_2 = "downloader.woripecs" ascii wide nocase
        $alias_3 = "win32/woripecs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WORIPECS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Woripecs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/woripecs"
        date = "2026-10-16"
    strings:
        $attrib_str = "woripecs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wowlik (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wowlik
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WOWLIK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wowlik (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wowlik"
        date = "2026-10-16"
    strings:
        $fam_name = "wowlik" ascii wide nocase
        $alias_1 = "adware:win32/wowlik" ascii wide nocase
        $alias_2 = "pua:win32/wowlik" ascii wide nocase
        $alias_3 = "adware.wowlik" ascii wide nocase
        $alias_4 = "win32/wowlik" ascii wide nocase
        $alias_5 = "adware:win32/wowlik.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WOWLIK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wowlik tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wowlik"
        date = "2026-10-16"
    strings:
        $attrib_str = "wowlik" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wpakill (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wpakill
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WPAKILL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wpakill (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wpakill"
        date = "2026-10-16"
    strings:
        $fam_name = "wpakill" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WPAKILL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wpakill tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wpakill"
        date = "2026-10-16"
    strings:
        $attrib_str = "wpakill" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wpepro (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wpepro
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WPEPRO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wpepro (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wpepro"
        date = "2026-10-16"
    strings:
        $fam_name = "wpepro" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WPEPRO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wpepro tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wpepro"
        date = "2026-10-16"
    strings:
        $attrib_str = "wpepro" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wrar (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wrar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WRAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wrar (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wrar"
        date = "2026-10-16"
    strings:
        $fam_name = "wrar" ascii wide nocase
        $alias_1 = "riskware.wrar" ascii wide nocase
        $alias_2 = "pup.wrar" ascii wide nocase
        $alias_3 = "hacktool.winrar.keygen" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WRAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wrar tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wrar"
        date = "2026-10-16"
    strings:
        $attrib_str = "wrar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Wraut (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wraut
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WRAUT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wraut (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wraut"
        date = "2026-10-16"
    strings:
        $fam_name = "wraut" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WRAUT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wraut tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wraut"
        date = "2026-10-16"
    strings:
        $attrib_str = "wraut" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Writos (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/writos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WRITOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Writos (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/writos"
        date = "2026-10-16"
    strings:
        $fam_name = "writos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WRITOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Writos tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/writos"
        date = "2026-10-16"
    strings:
        $attrib_str = "writos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wronginf (Rogue_Antivirus)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wronginf
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WRONGINF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wronginf (Rogue_Antivirus)"
        category = "Rogue_Antivirus"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wronginf"
        date = "2026-10-16"
    strings:
        $fam_name = "wronginf" ascii wide nocase
        $alias_1 = "rogue:win32/wronginf" ascii wide nocase
        $alias_2 = "trojan:win32/wronginf" ascii wide nocase
        $alias_3 = "win32:wronginf" ascii wide nocase
        $alias_4 = "rogue.wronginf" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WRONGINF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wronginf tradecraft"
        category = "Rogue_Antivirus"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wronginf"
        date = "2026-10-16"
    strings:
        $attrib_str = "wronginf" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Wsgame (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wsgame
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WSGAME_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wsgame (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wsgame"
        date = "2026-10-16"
    strings:
        $fam_name = "wsgame" ascii wide nocase
        $alias_1 = "trojan:win32/wsgame" ascii wide nocase
        $alias_2 = "trojan-gamethief.win32.wsgame" ascii wide nocase
        $alias_3 = "pws:win32/wsgame" ascii wide nocase
        $alias_4 = "wsgame stealer" ascii wide nocase
        $alias_5 = "win32/wsgame" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WSGAME_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wsgame tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wsgame"
        date = "2026-10-16"
    strings:
        $attrib_str = "wsgame" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Wswhacker (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wswhacker
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WSWHACKER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wswhacker (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wswhacker"
        date = "2026-10-16"
    strings:
        $fam_name = "wswhacker" ascii wide nocase
        $alias_1 = "hacktool.wswhacker" ascii wide nocase
        $alias_2 = "trojan.pws.wswhacker" ascii wide nocase
        $alias_3 = "win32/wswhacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WSWHACKER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wswhacker tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wswhacker"
        date = "2026-10-16"
    strings:
        $attrib_str = "wswhacker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Wuca (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wuca
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WUCA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wuca (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wuca"
        date = "2026-10-16"
    strings:
        $fam_name = "wuca" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WUCA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wuca tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wuca"
        date = "2026-10-16"
    strings:
        $attrib_str = "wuca" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wuji (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wuji
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WUJI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wuji (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wuji"
        date = "2026-10-16"
    strings:
        $fam_name = "wuji" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WUJI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wuji tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wuji"
        date = "2026-10-16"
    strings:
        $attrib_str = "wuji" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Wyhymyz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/wyhymyz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_WYHYMYZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Wyhymyz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wyhymyz"
        date = "2026-10-16"
    strings:
        $fam_name = "wyhymyz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_WYHYMYZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Wyhymyz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/wyhymyz"
        date = "2026-10-16"
    strings:
        $attrib_str = "wyhymyz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xanfpezes (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xanfpezes
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XANFPEZES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xanfpezes (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xanfpezes"
        date = "2026-10-16"
    strings:
        $fam_name = "xanfpezes" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XANFPEZES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xanfpezes tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xanfpezes"
        date = "2026-10-16"
    strings:
        $attrib_str = "xanfpezes" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xcomp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xcomp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XCOMP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xcomp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xcomp"
        date = "2026-10-16"
    strings:
        $fam_name = "xcomp" ascii wide nocase
        $alias_1 = "trojan.xcomp" ascii wide nocase
        $alias_2 = "downloader.xcomp" ascii wide nocase
        $alias_3 = "win32/xcomp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XCOMP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xcomp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xcomp"
        date = "2026-10-16"
    strings:
        $attrib_str = "xcomp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xdata (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xdata
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XDATA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xdata (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xdata"
        date = "2026-10-16"
    strings:
        $fam_name = "xdata" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XDATA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xdata tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xdata"
        date = "2026-10-16"
    strings:
        $attrib_str = "xdata" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xdisccorp (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xdisccorp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XDISCCORP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xdisccorp (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xdisccorp"
        date = "2026-10-16"
    strings:
        $fam_name = "xdisccorp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XDISCCORP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xdisccorp tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xdisccorp"
        date = "2026-10-16"
    strings:
        $attrib_str = "xdisccorp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xetapp (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xetapp
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XETAPP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xetapp (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xetapp"
        date = "2026-10-16"
    strings:
        $fam_name = "xetapp" ascii wide nocase
        $alias_1 = "adware:win32/xetapp" ascii wide nocase
        $alias_2 = "pua:win32/xetapp" ascii wide nocase
        $alias_3 = "softwarebundler:win32/xetapp" ascii wide nocase
        $alias_4 = "win32/xetapp" ascii wide nocase
        $alias_5 = "adware.xetapp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XETAPP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xetapp tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xetapp"
        date = "2026-10-16"
    strings:
        $attrib_str = "xetapp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Xiaoba (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xiaoba
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XIAOBA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xiaoba (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiaoba"
        date = "2026-10-16"
    strings:
        $fam_name = "xiaoba" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XIAOBA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xiaoba tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiaoba"
        date = "2026-10-16"
    strings:
        $attrib_str = "xiaoba" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xiaobaminer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xiaobaminer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XIAOBAMINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xiaobaminer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiaobaminer"
        date = "2026-10-16"
    strings:
        $fam_name = "xiaobaminer" ascii wide nocase
        $alias_1 = "trojan.coinminer.xiaoba" ascii wide nocase
        $alias_2 = "riskware.miner.xiaoba" ascii wide nocase
        $alias_3 = "win32/coinminer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XIAOBAMINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xiaobaminer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiaobaminer"
        date = "2026-10-16"
    strings:
        $attrib_str = "xiaobaminer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Xiaoxiong (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xiaoxiong
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XIAOXIONG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xiaoxiong (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiaoxiong"
        date = "2026-10-16"
    strings:
        $fam_name = "xiaoxiong" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XIAOXIONG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xiaoxiong tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiaoxiong"
        date = "2026-10-16"
    strings:
        $attrib_str = "xiaoxiong" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Xiazai (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xiazai
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XIAZAI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xiazai (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiazai"
        date = "2026-10-16"
    strings:
        $fam_name = "xiazai" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XIAZAI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xiazai tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiazai"
        date = "2026-10-16"
    strings:
        $attrib_str = "xiazai" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xiclog (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xiclog
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XICLOG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xiclog (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiclog"
        date = "2026-10-16"
    strings:
        $fam_name = "xiclog" ascii wide nocase
        $alias_1 = "backdoor:win32/xiclog" ascii wide nocase
        $alias_2 = "trojan:win32/xiclog" ascii wide nocase
        $alias_3 = "backdoor.xiclog" ascii wide nocase
        $alias_4 = "win32/xiclog" ascii wide nocase
        $alias_5 = "backdoor:win32/xiclog.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XICLOG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xiclog tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiclog"
        date = "2026-10-16"
    strings:
        $attrib_str = "xiclog" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Xihet (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xihet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XIHET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xihet (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xihet"
        date = "2026-10-16"
    strings:
        $fam_name = "xihet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XIHET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xihet tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xihet"
        date = "2026-10-16"
    strings:
        $attrib_str = "xihet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xiquitir (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xiquitir
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XIQUITIR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xiquitir (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiquitir"
        date = "2026-10-16"
    strings:
        $fam_name = "xiquitir" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XIQUITIR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xiquitir tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xiquitir"
        date = "2026-10-16"
    strings:
        $attrib_str = "xiquitir" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xizfawwyz0Ab (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xizfawwyz0ab
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XIZFAWWYZ0AB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xizfawwyz0Ab (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xizfawwyz0ab"
        date = "2026-10-16"
    strings:
        $fam_name = "xizfawwyz0ab" ascii wide nocase
        $alias_1 = "trojan.generic.xizfawwyz0ab" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XIZFAWWYZ0AB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xizfawwyz0Ab tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xizfawwyz0ab"
        date = "2026-10-16"
    strings:
        $attrib_str = "xizfawwyz0ab" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xkit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xkit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XKIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xkit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xkit"
        date = "2026-10-16"
    strings:
        $fam_name = "xkit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XKIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xkit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xkit"
        date = "2026-10-16"
    strings:
        $attrib_str = "xkit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xmgfa0Ysjgki (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xmgfa0ysjgki
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XMGFA0YSJGKI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xmgfa0Ysjgki (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xmgfa0ysjgki"
        date = "2026-10-16"
    strings:
        $fam_name = "xmgfa0ysjgki" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XMGFA0YSJGKI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xmgfa0Ysjgki tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xmgfa0ysjgki"
        date = "2026-10-16"
    strings:
        $attrib_str = "xmgfa0ysjgki" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xmgfbs8Lpqoib (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xmgfbs8lpqoib
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XMGFBS8LPQOIB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xmgfbs8Lpqoib (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xmgfbs8lpqoib"
        date = "2026-10-16"
    strings:
        $fam_name = "xmgfbs8lpqoib" ascii wide nocase
        $alias_1 = "trojan.obfuscated.gen" ascii wide nocase
        $alias_2 = "downloader.randomname" ascii wide nocase
        $alias_3 = "win32/trojan.crypt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XMGFBS8LPQOIB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xmgfbs8Lpqoib tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xmgfbs8lpqoib"
        date = "2026-10-16"
    strings:
        $attrib_str = "xmgfbs8lpqoib" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xmrig (Cryptominer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xmrig
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XMRIG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xmrig (Cryptominer)"
        category = "Cryptominer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xmrig"
        date = "2026-10-16"
    strings:
        $fam_name = "xmrig" ascii wide nocase
        $alias_1 = "coinminer:win32/xmrig" ascii wide nocase
        $alias_2 = "trojan.xmrig" ascii wide nocase
        $alias_3 = "xmrig miner" ascii wide nocase
        $alias_4 = "win32/xmrig" ascii wide nocase
        $alias_5 = "xmrig monero miner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XMRIG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xmrig tradecraft"
        category = "Cryptominer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xmrig"
        date = "2026-10-16"
    strings:
        $attrib_str = "xmrig" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Xmrigminer (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xmrigminer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XMRIGMINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xmrigminer (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xmrigminer"
        date = "2026-10-16"
    strings:
        $fam_name = "xmrigminer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XMRIGMINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xmrigminer tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xmrigminer"
        date = "2026-10-16"
    strings:
        $attrib_str = "xmrigminer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Xmrminer (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xmrminer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XMRMINER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xmrminer (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xmrminer"
        date = "2026-10-16"
    strings:
        $fam_name = "xmrminer" ascii wide nocase
        $alias_1 = "coinminer.xmr" ascii wide nocase
        $alias_2 = "trojan.xmrig" ascii wide nocase
        $alias_3 = "riskware.miner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XMRMINER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xmrminer tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xmrminer"
        date = "2026-10-16"
    strings:
        $attrib_str = "xmrminer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Xnhmeb (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xnhmeb
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XNHMEB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xnhmeb (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xnhmeb"
        date = "2026-10-16"
    strings:
        $fam_name = "xnhmeb" ascii wide nocase
        $alias_1 = "trojan.generic.xnhmeb" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XNHMEB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xnhmeb tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xnhmeb"
        date = "2026-10-16"
    strings:
        $attrib_str = "xnhmeb" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xorala (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xorala
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XORALA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xorala (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xorala"
        date = "2026-10-16"
    strings:
        $fam_name = "xorala" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XORALA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xorala tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xorala"
        date = "2026-10-16"
    strings:
        $attrib_str = "xorala" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xorer (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xorer
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XORER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xorer (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xorer"
        date = "2026-10-16"
    strings:
        $fam_name = "xorer" ascii wide nocase
        $alias_1 = "virus:win32/xorer" ascii wide nocase
        $alias_2 = "worm:win32/xorer" ascii wide nocase
        $alias_3 = "trojan.xorer" ascii wide nocase
        $alias_4 = "win32/xorer" ascii wide nocase
        $alias_5 = "xorer.worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XORER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xorer tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xorer"
        date = "2026-10-16"
    strings:
        $attrib_str = "xorer" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Xorist (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xorist
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XORIST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xorist (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xorist"
        date = "2026-10-16"
    strings:
        $fam_name = "xorist" ascii wide nocase
        $alias_1 = "ransom:win32/xorist" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.xorist" ascii wide nocase
        $alias_3 = "win32/xorist" ascii wide nocase
        $alias_4 = "xorist ransomware builder" ascii wide nocase
        $alias_5 = "trojan-ransom.win32.enigma" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XORIST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xorist tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xorist"
        date = "2026-10-16"
    strings:
        $attrib_str = "xorist" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xorpix (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xorpix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XORPIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xorpix (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xorpix"
        date = "2026-10-16"
    strings:
        $fam_name = "xorpix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XORPIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xorpix tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xorpix"
        date = "2026-10-16"
    strings:
        $attrib_str = "xorpix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xpaj (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xpaj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XPAJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xpaj (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xpaj"
        date = "2026-10-16"
    strings:
        $fam_name = "xpaj" ascii wide nocase
        $alias_1 = "virus:win32/xpaj" ascii wide nocase
        $alias_2 = "w32/xpaj.virus" ascii wide nocase
        $alias_3 = "win32/xpaj.b" ascii wide nocase
        $alias_4 = "trojan.win32.xpaj" ascii wide nocase
        $alias_5 = "xpaj infector" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XPAJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xpaj tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xpaj"
        date = "2026-10-16"
    strings:
        $attrib_str = "xpaj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Xpun (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xpun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XPUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xpun (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xpun"
        date = "2026-10-16"
    strings:
        $fam_name = "xpun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XPUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xpun tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xpun"
        date = "2026-10-16"
    strings:
        $attrib_str = "xpun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xpyn (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xpyn
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XPYN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xpyn (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xpyn"
        date = "2026-10-16"
    strings:
        $fam_name = "xpyn" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XPYN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xpyn tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xpyn"
        date = "2026-10-16"
    strings:
        $attrib_str = "xpyn" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xrat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xrat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xrat"
        date = "2026-10-16"
    strings:
        $fam_name = "xrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xrat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "xrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Xscan (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xscan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XSCAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xscan (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xscan"
        date = "2026-10-16"
    strings:
        $fam_name = "xscan" ascii wide nocase
        $alias_1 = "hacktool.xscan" ascii wide nocase
        $alias_2 = "riskware.scanner" ascii wide nocase
        $alias_3 = "win32/xscan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XSCAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xscan tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xscan"
        date = "2026-10-16"
    strings:
        $attrib_str = "xscan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Xtrat (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xtrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XTRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xtrat (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xtrat"
        date = "2026-10-16"
    strings:
        $fam_name = "xtrat" ascii wide nocase
        $alias_1 = "xtreme rat" ascii wide nocase
        $alias_2 = "xtremerat" ascii wide nocase
        $alias_3 = "xrat" ascii wide nocase
        $alias_4 = "xtrat" ascii wide nocase
        $alias_5 = "xrat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XTRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xtrat tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xtrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "xtrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Xundlldl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xundlldl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XUNDLLDL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xundlldl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xundlldl"
        date = "2026-10-16"
    strings:
        $fam_name = "xundlldl" ascii wide nocase
        $alias_1 = "trojan.downloader.dll" ascii wide nocase
        $alias_2 = "generic.xundlldl" ascii wide nocase
        $alias_3 = "win32/xundlldl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XUNDLLDL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xundlldl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xundlldl"
        date = "2026-10-16"
    strings:
        $attrib_str = "xundlldl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xunleihd (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xunleihd
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XUNLEIHD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xunleihd (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xunleihd"
        date = "2026-10-16"
    strings:
        $fam_name = "xunleihd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XUNLEIHD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xunleihd tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xunleihd"
        date = "2026-10-16"
    strings:
        $attrib_str = "xunleihd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Xxybsq (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxybsq
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYBSQ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxybsq (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybsq"
        date = "2026-10-16"
    strings:
        $fam_name = "xxybsq" ascii wide nocase
        $alias_1 = "trojan.xxybsq" ascii wide nocase
        $alias_2 = "generic.xxybsq" ascii wide nocase
        $alias_3 = "riskware.xxybsq" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYBSQ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxybsq tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybsq"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxybsq" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xxybss (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxybss
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYBSS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxybss (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybss"
        date = "2026-10-16"
    strings:
        $fam_name = "xxybss" ascii wide nocase
        $alias_1 = "generic.xxybss" ascii wide nocase
        $alias_2 = "suspicious.xxybss" ascii wide nocase
        $alias_3 = "heur.xxybss" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYBSS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxybss tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybss"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxybss" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Xxybtw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxybtw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYBTW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxybtw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybtw"
        date = "2026-10-16"
    strings:
        $fam_name = "xxybtw" ascii wide nocase
        $alias_1 = "generic.xxybtw" ascii wide nocase
        $alias_2 = "trojan.generic" ascii wide nocase
        $alias_3 = "suspicious.xxybtw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYBTW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxybtw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybtw"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxybtw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xxybuj (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxybuj
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYBUJ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxybuj (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybuj"
        date = "2026-10-16"
    strings:
        $fam_name = "xxybuj" ascii wide nocase
        $alias_1 = "generic.xxybuj" ascii wide nocase
        $alias_2 = "suspicious.xxybuj" ascii wide nocase
        $alias_3 = "heur.xxybuj" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYBUJ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxybuj tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybuj"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxybuj" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Xxybvi (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxybvi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYBVI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxybvi (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybvi"
        date = "2026-10-16"
    strings:
        $fam_name = "xxybvi" ascii wide nocase
        $alias_1 = "generic.xxybvi" ascii wide nocase
        $alias_2 = "suspicious.xxybvi" ascii wide nocase
        $alias_3 = "heur.xxybvi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYBVI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxybvi tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybvi"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxybvi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Xxybwe (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxybwe
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYBWE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxybwe (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybwe"
        date = "2026-10-16"
    strings:
        $fam_name = "xxybwe" ascii wide nocase
        $alias_1 = "generic.xxybwe" ascii wide nocase
        $alias_2 = "suspicious.xxybwe" ascii wide nocase
        $alias_3 = "heur.xxybwe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYBWE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxybwe tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybwe"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxybwe" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Xxybyu (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxybyu
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYBYU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxybyu (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybyu"
        date = "2026-10-16"
    strings:
        $fam_name = "xxybyu" ascii wide nocase
        $alias_1 = "generic.xxybyu" ascii wide nocase
        $alias_2 = "suspicious.xxybyu" ascii wide nocase
        $alias_3 = "heur.xxybyu" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYBYU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxybyu tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybyu"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxybyu" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Xxybzx (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxybzx
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYBZX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxybzx (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybzx"
        date = "2026-10-16"
    strings:
        $fam_name = "xxybzx" ascii wide nocase
        $alias_1 = "generic.xxybzx" ascii wide nocase
        $alias_2 = "suspicious.xxybzx" ascii wide nocase
        $alias_3 = "heur.xxybzx" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYBZX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxybzx tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxybzx"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxybzx" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Xxycbl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxycbl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYCBL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxycbl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxycbl"
        date = "2026-10-16"
    strings:
        $fam_name = "xxycbl" ascii wide nocase
        $alias_1 = "trojan.xxycbl" ascii wide nocase
        $alias_2 = "generic.xxycbl" ascii wide nocase
        $alias_3 = "suspicious.xxycbl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYCBL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxycbl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxycbl"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxycbl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xxycdl (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxycdl
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYCDL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxycdl (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxycdl"
        date = "2026-10-16"
    strings:
        $fam_name = "xxycdl" ascii wide nocase
        $alias_1 = "generic.xxycdl" ascii wide nocase
        $alias_2 = "trojan.generic" ascii wide nocase
        $alias_3 = "suspicious.xxycdl" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYCDL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxycdl tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxycdl"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxycdl" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xxycec (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxycec
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYCEC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxycec (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxycec"
        date = "2026-10-16"
    strings:
        $fam_name = "xxycec" ascii wide nocase
        $alias_1 = "trojan.xxycec" ascii wide nocase
        $alias_2 = "generic.xxycec" ascii wide nocase
        $alias_3 = "suspicious.xxycec" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYCEC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxycec tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxycec"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxycec" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xxycff (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxycff
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYCFF_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxycff (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxycff"
        date = "2026-10-16"
    strings:
        $fam_name = "xxycff" ascii wide nocase
        $alias_1 = "trojan.xxycff" ascii wide nocase
        $alias_2 = "generic.xxycff" ascii wide nocase
        $alias_3 = "suspicious.xxycff" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYCFF_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxycff tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxycff"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxycff" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xxychs (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxychs
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYCHS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxychs (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxychs"
        date = "2026-10-16"
    strings:
        $fam_name = "xxychs" ascii wide nocase
        $alias_1 = "trojan.xxychs" ascii wide nocase
        $alias_2 = "generic.xxychs" ascii wide nocase
        $alias_3 = "suspicious.xxychs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYCHS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxychs tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxychs"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxychs" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xxyeut (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxyeut
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYEUT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxyeut (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxyeut"
        date = "2026-10-16"
    strings:
        $fam_name = "xxyeut" ascii wide nocase
        $alias_1 = "trojan.xxyeut" ascii wide nocase
        $alias_2 = "downloader.xxyeut" ascii wide nocase
        $alias_3 = "win32/xxyeut" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYEUT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxyeut tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxyeut"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxyeut" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xxyfhz (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxyfhz
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYFHZ_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxyfhz (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxyfhz"
        date = "2026-10-16"
    strings:
        $fam_name = "xxyfhz" ascii wide nocase
        $alias_1 = "trojan.generic.xxyfhz" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYFHZ_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxyfhz tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxyfhz"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxyfhz" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xxyheo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xxyheo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XXYHEO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xxyheo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxyheo"
        date = "2026-10-16"
    strings:
        $fam_name = "xxyheo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XXYHEO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xxyheo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xxyheo"
        date = "2026-10-16"
    strings:
        $attrib_str = "xxyheo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xylauncher (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xylauncher
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XYLAUNCHER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xylauncher (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xylauncher"
        date = "2026-10-16"
    strings:
        $fam_name = "xylauncher" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XYLAUNCHER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xylauncher tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xylauncher"
        date = "2026-10-16"
    strings:
        $attrib_str = "xylauncher" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xyligan (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xyligan
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XYLIGAN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xyligan (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xyligan"
        date = "2026-10-16"
    strings:
        $fam_name = "xyligan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XYLIGAN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xyligan tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xyligan"
        date = "2026-10-16"
    strings:
        $attrib_str = "xyligan" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Xyntservice (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/xyntservice
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_XYNTSERVICE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Xyntservice (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xyntservice"
        date = "2026-10-16"
    strings:
        $fam_name = "xyntservice" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_XYNTSERVICE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Xyntservice tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/xyntservice"
        date = "2026-10-16"
    strings:
        $attrib_str = "xyntservice" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Y3K_Rat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/y3k_rat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_Y3K_RAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Y3K_Rat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/y3k_rat"
        date = "2026-10-16"
    strings:
        $fam_name = "y3k_rat" ascii wide nocase
        $alias_1 = "y3k rat" ascii wide nocase
        $alias_2 = "y3k 1.6" ascii wide nocase
        $alias_3 = "backdoor.y3k" ascii wide nocase
        $alias_4 = "trojan.win32.y3k" ascii wide nocase
        $alias_5 = "backdoor:win32/y3k" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_Y3K_RAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Y3K_Rat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/y3k_rat"
        date = "2026-10-16"
    strings:
        $attrib_str = "y3k_rat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Yabinder (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yabinder
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YABINDER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yabinder (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yabinder"
        date = "2026-10-16"
    strings:
        $fam_name = "yabinder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YABINDER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yabinder tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yabinder"
        date = "2026-10-16"
    strings:
        $attrib_str = "yabinder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Yahlover (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yahlover
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YAHLOVER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yahlover (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yahlover"
        date = "2026-10-16"
    strings:
        $fam_name = "yahlover" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YAHLOVER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yahlover tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yahlover"
        date = "2026-10-16"
    strings:
        $attrib_str = "yahlover" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Yahoopass (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yahoopass
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YAHOOPASS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yahoopass (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yahoopass"
        date = "2026-10-16"
    strings:
        $fam_name = "yahoopass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YAHOOPASS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yahoopass tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yahoopass"
        date = "2026-10-16"
    strings:
        $attrib_str = "yahoopass" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Yakbeex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yakbeex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YAKBEEX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yakbeex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yakbeex"
        date = "2026-10-16"
    strings:
        $fam_name = "yakbeex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YAKBEEX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yakbeex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yakbeex"
        date = "2026-10-16"
    strings:
        $attrib_str = "yakbeex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Yakes (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yakes
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YAKES_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yakes (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yakes"
        date = "2026-10-16"
    strings:
        $fam_name = "yakes" ascii wide nocase
        $alias_1 = "yakes" ascii wide nocase
        $alias_2 = "trojan:win32/yakes" ascii wide nocase
        $alias_3 = "trojan.yakes" ascii wide nocase
        $alias_4 = "win32/yakes" ascii wide nocase
        $alias_5 = "yakes downloader" ascii wide nocase
        $alias_6 = "dorkbot-yakes" ascii wide nocase
        $alias_7 = "trojan.win32.yakes" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YAKES_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yakes tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yakes"
        date = "2026-10-16"
    strings:
        $attrib_str = "yakes" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Yantai (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yantai
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YANTAI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yantai (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yantai"
        date = "2026-10-16"
    strings:
        $fam_name = "yantai" ascii wide nocase
        $alias_1 = "trojandownloader:win32/yantai" ascii wide nocase
        $alias_2 = "trojan:win32/yantai" ascii wide nocase
        $alias_3 = "win32/yantai" ascii wide nocase
        $alias_4 = "yantai downloader" ascii wide nocase
        $alias_5 = "backdoor:win32/yantai" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YANTAI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yantai tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yantai"
        date = "2026-10-16"
    strings:
        $attrib_str = "yantai" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Yelloader (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yelloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YELLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yelloader (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yelloader"
        date = "2026-10-16"
    strings:
        $fam_name = "yelloader" ascii wide nocase
        $alias_1 = "trojandownloader:win32/yelloader" ascii wide nocase
        $alias_2 = "trojan:win32/yelloader" ascii wide nocase
        $alias_3 = "trojan.yelloader" ascii wide nocase
        $alias_4 = "win32/yelloader" ascii wide nocase
        $alias_5 = "trojandownloader:win32/yelloader.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YELLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yelloader tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yelloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "yelloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Yiwanzhushou (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yiwanzhushou
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YIWANZHUSHOU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yiwanzhushou (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yiwanzhushou"
        date = "2026-10-16"
    strings:
        $fam_name = "yiwanzhushou" ascii wide nocase
        $alias_1 = "adware.yiwanzhushou" ascii wide nocase
        $alias_2 = "pup.yiwanzhushou" ascii wide nocase
        $alias_3 = "win32/adware.hijacker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YIWANZHUSHOU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yiwanzhushou tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yiwanzhushou"
        date = "2026-10-16"
    strings:
        $attrib_str = "yiwanzhushou" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Ymkfawdgfnmi (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ymkfawdgfnmi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YMKFAWDGFNMI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ymkfawdgfnmi (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ymkfawdgfnmi"
        date = "2026-10-16"
    strings:
        $fam_name = "ymkfawdgfnmi" ascii wide nocase
        $alias_1 = "generic.dga" ascii wide nocase
        $alias_2 = "suspicious.ymkfawdgfnmi" ascii wide nocase
        $alias_3 = "heur.ymkfawdgfnmi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YMKFAWDGFNMI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ymkfawdgfnmi tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ymkfawdgfnmi"
        date = "2026-10-16"
    strings:
        $attrib_str = "ymkfawdgfnmi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Yobdam (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yobdam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YOBDAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yobdam (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yobdam"
        date = "2026-10-16"
    strings:
        $fam_name = "yobdam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YOBDAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yobdam tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yobdam"
        date = "2026-10-16"
    strings:
        $attrib_str = "yobdam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Yobrowser (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yobrowser
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YOBROWSER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yobrowser (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yobrowser"
        date = "2026-10-16"
    strings:
        $fam_name = "yobrowser" ascii wide nocase
        $alias_1 = "pua:win32/yobrowser" ascii wide nocase
        $alias_2 = "trojan:win32/yobrowser" ascii wide nocase
        $alias_3 = "adware:win32/yobrowser" ascii wide nocase
        $alias_4 = "yobrowser" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YOBROWSER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yobrowser tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yobrowser"
        date = "2026-10-16"
    strings:
        $attrib_str = "yobrowser" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Yoddos (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yoddos
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YODDOS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yoddos (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yoddos"
        date = "2026-10-16"
    strings:
        $fam_name = "yoddos" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YODDOS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yoddos tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yoddos"
        date = "2026-10-16"
    strings:
        $attrib_str = "yoddos" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Yolov (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yolov
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YOLOV_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yolov (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yolov"
        date = "2026-10-16"
    strings:
        $fam_name = "yolov" ascii wide nocase
        $alias_1 = "trojan.yolov" ascii wide nocase
        $alias_2 = "downloader.yolov" ascii wide nocase
        $alias_3 = "win32/yolov" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YOLOV_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yolov tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yolov"
        date = "2026-10-16"
    strings:
        $attrib_str = "yolov" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Younglotus (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/younglotus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YOUNGLOTUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Younglotus (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/younglotus"
        date = "2026-10-16"
    strings:
        $fam_name = "younglotus" ascii wide nocase
        $alias_1 = "apt.younglotus" ascii wide nocase
        $alias_2 = "backdoor.oceanlotus" ascii wide nocase
        $alias_3 = "trojan.apt32" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YOUNGLOTUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Younglotus tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/younglotus"
        date = "2026-10-16"
    strings:
        $attrib_str = "younglotus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Youtubedownloaderguru (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/youtubedownloaderguru
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YOUTUBEDOWNLOADERGURU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Youtubedownloaderguru (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/youtubedownloaderguru"
        date = "2026-10-16"
    strings:
        $fam_name = "youtubedownloaderguru" ascii wide nocase
        $alias_1 = "adware.youtubedownloader" ascii wide nocase
        $alias_2 = "pup.videodownloader" ascii wide nocase
        $alias_3 = "browsermodifier:win32/youtubedownloaderguru" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YOUTUBEDOWNLOADERGURU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Youtubedownloaderguru tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/youtubedownloaderguru"
        date = "2026-10-16"
    strings:
        $attrib_str = "youtubedownloaderguru" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Youxun (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/youxun
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YOUXUN_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Youxun (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/youxun"
        date = "2026-10-16"
    strings:
        $fam_name = "youxun" ascii wide nocase
        $alias_1 = "adware:win32/youxun" ascii wide nocase
        $alias_2 = "pua:win32/youxun" ascii wide nocase
        $alias_3 = "win32/youxun" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YOUXUN_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Youxun tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/youxun"
        date = "2026-10-16"
    strings:
        $attrib_str = "youxun" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ytddownloader (Pua)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ytddownloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YTDDOWNLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ytddownloader (Pua)"
        category = "Pua"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ytddownloader"
        date = "2026-10-16"
    strings:
        $fam_name = "ytddownloader" ascii wide nocase
        $alias_1 = "pua:win32/ytddownloader" ascii wide nocase
        $alias_2 = "softwarebundler:win32/ytdvideodownloader" ascii wide nocase
        $alias_3 = "pup.optional.ytddownloader" ascii wide nocase
        $alias_4 = "adware:win32/ytddownloader" ascii wide nocase
        $alias_5 = "win32/ytdvideodownloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YTDDOWNLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ytddownloader tradecraft"
        category = "Pua"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ytddownloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "ytddownloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Ytdownloader (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/ytdownloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YTDOWNLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Ytdownloader (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ytdownloader"
        date = "2026-10-16"
    strings:
        $fam_name = "ytdownloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YTDOWNLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Ytdownloader tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/ytdownloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "ytdownloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Yuner (File_Infector)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yuner
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YUNER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yuner (File_Infector)"
        category = "File_Infector"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yuner"
        date = "2026-10-16"
    strings:
        $fam_name = "yuner" ascii wide nocase
        $alias_1 = "virus:win32/yuner" ascii wide nocase
        $alias_2 = "worm:win32/yuner" ascii wide nocase
        $alias_3 = "virus.win32.yuner" ascii wide nocase
        $alias_4 = "win32/yuner" ascii wide nocase
        $alias_5 = "w32/yuner" ascii wide nocase
        $alias_6 = "virus:win32/yuner.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YUNER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yuner tradecraft"
        category = "File_Infector"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yuner"
        date = "2026-10-16"
    strings:
        $attrib_str = "yuner" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Yunsip (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yunsip
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YUNSIP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yunsip (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yunsip"
        date = "2026-10-16"
    strings:
        $fam_name = "yunsip" ascii wide nocase
        $alias_1 = "pws:win32/yunsip" ascii wide nocase
        $alias_2 = "trojan:win32/yunsip" ascii wide nocase
        $alias_3 = "pws:win32/yunsip.a" ascii wide nocase
        $alias_4 = "trojan.yunsip" ascii wide nocase
        $alias_5 = "win32/yunsip" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YUNSIP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yunsip tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yunsip"
        date = "2026-10-16"
    strings:
        $attrib_str = "yunsip" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Yuri (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yuri
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YURI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yuri (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yuri"
        date = "2026-10-16"
    strings:
        $fam_name = "yuri" ascii wide nocase
        $alias_1 = "backdoor.yuri" ascii wide nocase
        $alias_2 = "rat.yuri" ascii wide nocase
        $alias_3 = "win32/yuri" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YURI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yuri tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yuri"
        date = "2026-10-16"
    strings:
        $attrib_str = "yuri" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Yy0Aueeqipni (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yy0aueeqipni
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YY0AUEEQIPNI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yy0Aueeqipni (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yy0aueeqipni"
        date = "2026-10-16"
    strings:
        $fam_name = "yy0aueeqipni" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YY0AUEEQIPNI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yy0Aueeqipni tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yy0aueeqipni"
        date = "2026-10-16"
    strings:
        $attrib_str = "yy0aueeqipni" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Yywaa08Jovdg (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/yywaa08jovdg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_YYWAA08JOVDG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Yywaa08Jovdg (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yywaa08jovdg"
        date = "2026-10-16"
    strings:
        $fam_name = "yywaa08jovdg" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_YYWAA08JOVDG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Yywaa08Jovdg tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/yywaa08jovdg"
        date = "2026-10-16"
    strings:
        $attrib_str = "yywaa08jovdg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Z_Dem0N (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/z_dem0n
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_Z_DEM0N_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Z_Dem0N (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/z_dem0n"
        date = "2026-10-16"
    strings:
        $fam_name = "z_dem0n" ascii wide nocase
        $alias_1 = "z-dem0n" ascii wide nocase
        $alias_2 = "z-demon" ascii wide nocase
        $alias_3 = "backdoor.zdemon" ascii wide nocase
        $alias_4 = "z-dem0n by znash" ascii wide nocase
        $alias_5 = "backdoor:win32/zdemon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_Z_DEM0N_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Z_Dem0N tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/z_dem0n"
        date = "2026-10-16"
    strings:
        $attrib_str = "z_dem0n" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Za0Au42Rofm (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/za0au42rofm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZA0AU42ROFM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Za0Au42Rofm (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/za0au42rofm"
        date = "2026-10-16"
    strings:
        $fam_name = "za0au42rofm" ascii wide nocase
        $alias_1 = "trojan.generic.za0au42rofm" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZA0AU42ROFM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Za0Au42Rofm tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/za0au42rofm"
        date = "2026-10-16"
    strings:
        $attrib_str = "za0au42rofm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zacinlo (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zacinlo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZACINLO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zacinlo (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zacinlo"
        date = "2026-10-16"
    strings:
        $fam_name = "zacinlo" ascii wide nocase
        $alias_1 = "adware.zacinlo" ascii wide nocase
        $alias_2 = "rootkit.zacinlo" ascii wide nocase
        $alias_3 = "win32/zacinlo.rootkit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZACINLO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zacinlo tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zacinlo"
        date = "2026-10-16"
    strings:
        $attrib_str = "zacinlo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Zacom (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zacom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZACOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zacom (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zacom"
        date = "2026-10-16"
    strings:
        $fam_name = "zacom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZACOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zacom tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zacom"
        date = "2026-10-16"
    strings:
        $attrib_str = "zacom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zafi (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zafi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZAFI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zafi (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zafi"
        date = "2026-10-16"
    strings:
        $fam_name = "zafi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZAFI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zafi tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zafi"
        date = "2026-10-16"
    strings:
        $attrib_str = "zafi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Zamg (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zamg
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZAMG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zamg (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zamg"
        date = "2026-10-16"
    strings:
        $fam_name = "zamg" ascii wide nocase
        $alias_1 = "trojan:win32/zamg" ascii wide nocase
        $alias_2 = "trojan.mint.zamg" ascii wide nocase
        $alias_3 = "trojan:win32/zamg.a!bit" ascii wide nocase
        $alias_4 = "trojan.zamg" ascii wide nocase
        $alias_5 = "win32/zamg.dropper" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZAMG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zamg tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zamg"
        date = "2026-10-16"
    strings:
        $attrib_str = "zamg" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zanoza (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zanoza
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZANOZA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zanoza (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zanoza"
        date = "2026-10-16"
    strings:
        $fam_name = "zanoza" ascii wide nocase
        $alias_1 = "trojan.zanoza" ascii wide nocase
        $alias_2 = "downloader.zanoza" ascii wide nocase
        $alias_3 = "win32/zanoza" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZANOZA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zanoza tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zanoza"
        date = "2026-10-16"
    strings:
        $attrib_str = "zanoza" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zapchast (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zapchast
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZAPCHAST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zapchast (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zapchast"
        date = "2026-10-16"
    strings:
        $fam_name = "zapchast" ascii wide nocase
        $alias_1 = "trojan:win32/zapchast" ascii wide nocase
        $alias_2 = "trojan-psw.win32.zapchast" ascii wide nocase
        $alias_3 = "pws:win32/zapchast" ascii wide nocase
        $alias_4 = "win32/zapchast" ascii wide nocase
        $alias_5 = "trojan.zapchast" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZAPCHAST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zapchast tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zapchast"
        date = "2026-10-16"
    strings:
        $attrib_str = "zapchast" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zapinit (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zapinit
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZAPINIT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zapinit (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zapinit"
        date = "2026-10-16"
    strings:
        $fam_name = "zapinit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZAPINIT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zapinit tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zapinit"
        date = "2026-10-16"
    strings:
        $attrib_str = "zapinit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zard (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zard
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZARD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zard (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zard"
        date = "2026-10-16"
    strings:
        $fam_name = "zard" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZARD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zard tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zard"
        date = "2026-10-16"
    strings:
        $attrib_str = "zard" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zaxar (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zaxar
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZAXAR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zaxar (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zaxar"
        date = "2026-10-16"
    strings:
        $fam_name = "zaxar" ascii wide nocase
        $alias_1 = "botnet.zaxar" ascii wide nocase
        $alias_2 = "trojan.zaxar" ascii wide nocase
        $alias_3 = "backdoor.win32.zaxar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZAXAR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zaxar tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zaxar"
        date = "2026-10-16"
    strings:
        $attrib_str = "zaxar" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zbiw (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zbiw
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZBIW_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zbiw (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zbiw"
        date = "2026-10-16"
    strings:
        $fam_name = "zbiw" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZBIW_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zbiw tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zbiw"
        date = "2026-10-16"
    strings:
        $attrib_str = "zbiw" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zbot (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zbot (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zbot"
        date = "2026-10-16"
    strings:
        $fam_name = "zbot" ascii wide nocase
        $alias_1 = "zeus" ascii wide nocase
        $alias_2 = "zbot" ascii wide nocase
        $alias_3 = "gameover zeus" ascii wide nocase
        $alias_4 = "zeus panda" ascii wide nocase
        $alias_5 = "wsnpoem" ascii wide nocase
        $alias_6 = "trojan-spy.win32.zbot" ascii wide nocase
        $alias_7 = "win32/zbot" ascii wide nocase
        $alias_8 = "trojan:win32/zbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zbot tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "zbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zboter (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zboter
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZBOTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zboter (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zboter"
        date = "2026-10-16"
    strings:
        $fam_name = "zboter" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZBOTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zboter tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zboter"
        date = "2026-10-16"
    strings:
        $attrib_str = "zboter" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zdengo (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zdengo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZDENGO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zdengo (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zdengo"
        date = "2026-10-16"
    strings:
        $fam_name = "zdengo" ascii wide nocase
        $alias_1 = "adware.zdengo" ascii wide nocase
        $alias_2 = "trojan:win32/zdengo" ascii wide nocase
        $alias_3 = "zdengo.a" ascii wide nocase
        $alias_4 = "win32/zdengo" ascii wide nocase
        $alias_5 = "pua:win32/zdengo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZDENGO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zdengo tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zdengo"
        date = "2026-10-16"
    strings:
        $attrib_str = "zdengo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Zdowbot (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zdowbot
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZDOWBOT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zdowbot (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zdowbot"
        date = "2026-10-16"
    strings:
        $fam_name = "zdowbot" ascii wide nocase
        $alias_1 = "trojan.zdowbot" ascii wide nocase
        $alias_2 = "botnet.zdowbot" ascii wide nocase
        $alias_3 = "win32/zdowbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZDOWBOT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zdowbot tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zdowbot"
        date = "2026-10-16"
    strings:
        $attrib_str = "zdowbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zebrocy (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zebrocy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZEBROCY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zebrocy (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zebrocy"
        date = "2026-10-16"
    strings:
        $fam_name = "zebrocy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZEBROCY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zebrocy tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zebrocy"
        date = "2026-10-16"
    strings:
        $attrib_str = "zebrocy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zegost (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zegost
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZEGOST_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zegost (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zegost"
        date = "2026-10-16"
    strings:
        $fam_name = "zegost" ascii wide nocase
        $alias_1 = "zegost" ascii wide nocase
        $alias_2 = "trojan:win32/zegost" ascii wide nocase
        $alias_3 = "backdoor.zegost" ascii wide nocase
        $alias_4 = "trojan.zegost" ascii wide nocase
        $alias_5 = "zegost rat" ascii wide nocase
        $alias_6 = "win32/zegost" ascii wide nocase
        $alias_7 = "backdoor:win32/zegost" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZEGOST_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zegost tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zegost"
        date = "2026-10-16"
    strings:
        $attrib_str = "zegost" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Zeleffo (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zeleffo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZELEFFO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zeleffo (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zeleffo"
        date = "2026-10-16"
    strings:
        $fam_name = "zeleffo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZELEFFO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zeleffo tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zeleffo"
        date = "2026-10-16"
    strings:
        $attrib_str = "zeleffo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zenfly (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zenfly
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZENFLY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zenfly (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zenfly"
        date = "2026-10-16"
    strings:
        $fam_name = "zenfly" ascii wide nocase
        $alias_1 = "trojan.zenfly" ascii wide nocase
        $alias_2 = "downloader.zenfly" ascii wide nocase
        $alias_3 = "win32/zenfly" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZENFLY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zenfly tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zenfly"
        date = "2026-10-16"
    strings:
        $attrib_str = "zenfly" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zenosearch (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zenosearch
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZENOSEARCH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zenosearch (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zenosearch"
        date = "2026-10-16"
    strings:
        $fam_name = "zenosearch" ascii wide nocase
        $alias_1 = "adware.zenosearch" ascii wide nocase
        $alias_2 = "pup.zenosearch" ascii wide nocase
        $alias_3 = "browsermodifier:win32/zenosearch" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZENOSEARCH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zenosearch tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zenosearch"
        date = "2026-10-16"
    strings:
        $attrib_str = "zenosearch" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Zenpak (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zenpak
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZENPAK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zenpak (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zenpak"
        date = "2026-10-16"
    strings:
        $fam_name = "zenpak" ascii wide nocase
        $alias_1 = "ransom:win32/zenpak" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.zenpak" ascii wide nocase
        $alias_3 = "trojan.zenpak" ascii wide nocase
        $alias_4 = "win32/zenpak" ascii wide nocase
        $alias_5 = "ransom:win32/zenpak.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZENPAK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zenpak tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zenpak"
        date = "2026-10-16"
    strings:
        $attrib_str = "zenpak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zepfod (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zepfod
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZEPFOD_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zepfod (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zepfod"
        date = "2026-10-16"
    strings:
        $fam_name = "zepfod" ascii wide nocase
        $alias_1 = "trojan:win32/zepfod" ascii wide nocase
        $alias_2 = "trojan.win32.zepfod" ascii wide nocase
        $alias_3 = "trojandownloader:win32/zepfod" ascii wide nocase
        $alias_4 = "win32/zepfod" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZEPFOD_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zepfod tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zepfod"
        date = "2026-10-16"
    strings:
        $attrib_str = "zepfod" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zepto (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zepto
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZEPTO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zepto (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zepto"
        date = "2026-10-16"
    strings:
        $fam_name = "zepto" ascii wide nocase
        $alias_1 = "ransomware.zepto" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.locky.zepto" ascii wide nocase
        $alias_3 = "filecoder.zepto" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZEPTO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zepto tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zepto"
        date = "2026-10-16"
    strings:
        $attrib_str = "zepto" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zerber (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zerber
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZERBER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zerber (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zerber"
        date = "2026-10-16"
    strings:
        $fam_name = "zerber" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZERBER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zerber tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zerber"
        date = "2026-10-16"
    strings:
        $attrib_str = "zerber" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zero (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zero
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZERO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zero (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zero"
        date = "2026-10-16"
    strings:
        $fam_name = "zero" ascii wide nocase
        $alias_1 = "rootkit.zeroaccess" ascii wide nocase
        $alias_2 = "trojan.sirefef" ascii wide nocase
        $alias_3 = "win32/zeroaccess" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZERO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zero tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zero"
        date = "2026-10-16"
    strings:
        $attrib_str = "zero" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zeroaccess (Rootkit)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zeroaccess
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZEROACCESS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zeroaccess (Rootkit)"
        category = "Rootkit"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zeroaccess"
        date = "2026-10-16"
    strings:
        $fam_name = "zeroaccess" ascii wide nocase
        $alias_1 = "rootkit:win32/sirefef" ascii wide nocase
        $alias_2 = "trojan:win32/zeroaccess" ascii wide nocase
        $alias_3 = "rootkit:win32/zeroaccess" ascii wide nocase
        $alias_4 = "win32/sirefef" ascii wide nocase
        $alias_5 = "backdoor:win32/sirefef" ascii wide nocase
        $alias_6 = "sirefef rootkit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZEROACCESS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zeroaccess tradecraft"
        category = "Rootkit"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zeroaccess"
        date = "2026-10-16"
    strings:
        $attrib_str = "zeroaccess" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Zesibund (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zesibund
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZESIBUND_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zesibund (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zesibund"
        date = "2026-10-16"
    strings:
        $fam_name = "zesibund" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZESIBUND_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zesibund tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zesibund"
        date = "2026-10-16"
    strings:
        $attrib_str = "zesibund" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zeusvm (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zeusvm
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZEUSVM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zeusvm (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zeusvm"
        date = "2026-10-16"
    strings:
        $fam_name = "zeusvm" ascii wide nocase
        $alias_1 = "zeusvm" ascii wide nocase
        $alias_2 = "zbot.vm" ascii wide nocase
        $alias_3 = "trojan.zeusvm" ascii wide nocase
        $alias_4 = "win32/zeusvm" ascii wide nocase
        $alias_5 = "kins" ascii wide nocase
        $alias_6 = "trojan-banker.win32.zeusvm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZEUSVM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zeusvm tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zeusvm"
        date = "2026-10-16"
    strings:
        $attrib_str = "zeusvm" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zilix (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zilix
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZILIX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zilix (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zilix"
        date = "2026-10-16"
    strings:
        $fam_name = "zilix" ascii wide nocase
        $alias_1 = "trojan.zilix" ascii wide nocase
        $alias_2 = "downloader.zilix" ascii wide nocase
        $alias_3 = "win32/zilix" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZILIX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zilix tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zilix"
        date = "2026-10-16"
    strings:
        $attrib_str = "zilix" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zippyloader (Trojan_Downloader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zippyloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZIPPYLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zippyloader (Trojan_Downloader)"
        category = "Trojan_Downloader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zippyloader"
        date = "2026-10-16"
    strings:
        $fam_name = "zippyloader" ascii wide nocase
        $alias_1 = "trojandownloader:win32/zippyloader" ascii wide nocase
        $alias_2 = "trojan:win32/zippyloader" ascii wide nocase
        $alias_3 = "dropper.zippyloader" ascii wide nocase
        $alias_4 = "win32/zippyloader" ascii wide nocase
        $alias_5 = "trojandownloader:win32/zippyloader.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZIPPYLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zippyloader tradecraft"
        category = "Trojan_Downloader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zippyloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "zippyloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zjaisino (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zjaisino
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZJAISINO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zjaisino (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zjaisino"
        date = "2026-10-16"
    strings:
        $fam_name = "zjaisino" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZJAISINO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zjaisino tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zjaisino"
        date = "2026-10-16"
    strings:
        $attrib_str = "zjaisino" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zjek (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zjek
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZJEK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zjek (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zjek"
        date = "2026-10-16"
    strings:
        $fam_name = "zjek" ascii wide nocase
        $alias_1 = "trojan.zjek" ascii wide nocase
        $alias_2 = "downloader.zjek" ascii wide nocase
        $alias_3 = "win32/zjek" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZJEK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zjek tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zjek"
        date = "2026-10-16"
    strings:
        $attrib_str = "zjek" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zlob (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zlob
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZLOB_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zlob (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zlob"
        date = "2026-10-16"
    strings:
        $fam_name = "zlob" ascii wide nocase
        $alias_1 = "trojan:win32/zlob" ascii wide nocase
        $alias_2 = "trojan.zlob" ascii wide nocase
        $alias_3 = "win32/zlob.trojan" ascii wide nocase
        $alias_4 = "dnschanger.zlob" ascii wide nocase
        $alias_5 = "trojan-downloader.win32.zlob" ascii wide nocase
        $alias_6 = "zlob video codec" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZLOB_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zlob tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zlob"
        date = "2026-10-16"
    strings:
        $attrib_str = "zlob" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zloyfly (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zloyfly
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZLOYFLY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zloyfly (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zloyfly"
        date = "2026-10-16"
    strings:
        $fam_name = "zloyfly" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZLOYFLY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zloyfly tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zloyfly"
        date = "2026-10-16"
    strings:
        $attrib_str = "zloyfly" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zmem (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zmem
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZMEM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zmem (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zmem"
        date = "2026-10-16"
    strings:
        $fam_name = "zmem" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZMEM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zmem tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zmem"
        date = "2026-10-16"
    strings:
        $attrib_str = "zmem" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zoldon (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zoldon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZOLDON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zoldon (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zoldon"
        date = "2026-10-16"
    strings:
        $fam_name = "zoldon" ascii wide nocase
        $alias_1 = "trojan.zoldon" ascii wide nocase
        $alias_2 = "botnet.zoldon" ascii wide nocase
        $alias_3 = "win32/zoldon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZOLDON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zoldon tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zoldon"
        date = "2026-10-16"
    strings:
        $attrib_str = "zoldon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zombam (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zombam
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZOMBAM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zombam (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zombam"
        date = "2026-10-16"
    strings:
        $fam_name = "zombam" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZOMBAM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zombam tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zombam"
        date = "2026-10-16"
    strings:
        $attrib_str = "zombam" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zombieboy (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zombieboy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZOMBIEBOY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zombieboy (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zombieboy"
        date = "2026-10-16"
    strings:
        $fam_name = "zombieboy" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZOMBIEBOY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zombieboy tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zombieboy"
        date = "2026-10-16"
    strings:
        $attrib_str = "zombieboy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zombierat (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zombierat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZOMBIERAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zombierat (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zombierat"
        date = "2026-10-16"
    strings:
        $fam_name = "zombierat" ascii wide nocase
        $alias_1 = "zombierat" ascii wide nocase
        $alias_2 = "backdoor.win32.zombierat" ascii wide nocase
        $alias_3 = "zombie rat by the bo$$" ascii wide nocase
        $alias_4 = "zombierat 1.0" ascii wide nocase
        $alias_5 = "backdoor:win32/zombierat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZOMBIERAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zombierat tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zombierat"
        date = "2026-10-16"
    strings:
        $attrib_str = "zombierat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zonebac (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zonebac
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZONEBAC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zonebac (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zonebac"
        date = "2026-10-16"
    strings:
        $fam_name = "zonebac" ascii wide nocase
        $alias_1 = "trojan.zonebac" ascii wide nocase
        $alias_2 = "downloader.zonebac" ascii wide nocase
        $alias_3 = "win32/zonebac" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZONEBAC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zonebac tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zonebac"
        date = "2026-10-16"
    strings:
        $attrib_str = "zonebac" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zonidel (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zonidel
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZONIDEL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zonidel (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zonidel"
        date = "2026-10-16"
    strings:
        $fam_name = "zonidel" ascii wide nocase
        $alias_1 = "ransom:win32/zonidel" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.zonidel" ascii wide nocase
        $alias_3 = "win32/zonidel" ascii wide nocase
        $alias_4 = "ransom.zonidel" ascii wide nocase
        $alias_5 = "zonidel ransomware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZONIDEL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zonidel tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zonidel"
        date = "2026-10-16"
    strings:
        $attrib_str = "zonidel" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zonobindi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zonobindi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZONOBINDI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zonobindi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zonobindi"
        date = "2026-10-16"
    strings:
        $fam_name = "zonobindi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZONOBINDI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zonobindi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zonobindi"
        date = "2026-10-16"
    strings:
        $attrib_str = "zonobindi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zorex (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zorex
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZOREX_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zorex (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zorex"
        date = "2026-10-16"
    strings:
        $fam_name = "zorex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZOREX_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zorex tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zorex"
        date = "2026-10-16"
    strings:
        $attrib_str = "zorex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zpevdo (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zpevdo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZPEVDO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zpevdo (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zpevdo"
        date = "2026-10-16"
    strings:
        $fam_name = "zpevdo" ascii wide nocase
        $alias_1 = "zpevdo" ascii wide nocase
        $alias_2 = "trojan:win32/zpevdo" ascii wide nocase
        $alias_3 = "trojan.win32.zpevdo" ascii wide nocase
        $alias_4 = "win32/zpevdo" ascii wide nocase
        $alias_5 = "downloader.zpevdo" ascii wide nocase
        $alias_6 = "trojan.zpevdo" ascii wide nocase
        $alias_7 = "zpevdo loader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZPEVDO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zpevdo tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zpevdo"
        date = "2026-10-16"
    strings:
        $attrib_str = "zpevdo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zs0Bbeypkrh (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zs0bbeypkrh
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZS0BBEYPKRH_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zs0Bbeypkrh (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zs0bbeypkrh"
        date = "2026-10-16"
    strings:
        $fam_name = "zs0bbeypkrh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZS0BBEYPKRH_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zs0Bbeypkrh tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zs0bbeypkrh"
        date = "2026-10-16"
    strings:
        $attrib_str = "zs0bbeypkrh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zudochka (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zudochka
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZUDOCHKA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zudochka (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zudochka"
        date = "2026-10-16"
    strings:
        $fam_name = "zudochka" ascii wide nocase
        $alias_1 = "trojan.zudochka" ascii wide nocase
        $alias_2 = "downloader.zudochka" ascii wide nocase
        $alias_3 = "win32/zudochka" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZUDOCHKA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zudochka tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zudochka"
        date = "2026-10-16"
    strings:
        $attrib_str = "zudochka" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zugo (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zugo
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZUGO_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zugo (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zugo"
        date = "2026-10-16"
    strings:
        $fam_name = "zugo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZUGO_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zugo tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zugo"
        date = "2026-10-16"
    strings:
        $attrib_str = "zugo" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Zumanek (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zumanek
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZUMANEK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zumanek (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zumanek"
        date = "2026-10-16"
    strings:
        $fam_name = "zumanek" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZUMANEK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zumanek tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zumanek"
        date = "2026-10-16"
    strings:
        $attrib_str = "zumanek" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zurgop (Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zurgop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZURGOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zurgop (Trojan)"
        category = "Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zurgop"
        date = "2026-10-16"
    strings:
        $fam_name = "zurgop" ascii wide nocase
        $alias_1 = "trojan:win32/zurgop" ascii wide nocase
        $alias_2 = "trojandownloader:win32/zurgop" ascii wide nocase
        $alias_3 = "trojan.zurgop" ascii wide nocase
        $alias_4 = "win32/zurgop" ascii wide nocase
        $alias_5 = "trojan:win32/zurgop.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZURGOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zurgop tradecraft"
        category = "Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zurgop"
        date = "2026-10-16"
    strings:
        $attrib_str = "zurgop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zusy (Banking_Trojan)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zusy
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZUSY_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zusy (Banking_Trojan)"
        category = "Banking_Trojan"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zusy"
        date = "2026-10-16"
    strings:
        $fam_name = "zusy" ascii wide nocase
        $alias_1 = "tinba" ascii wide nocase
        $alias_2 = "tiny banker" ascii wide nocase
        $alias_3 = "zusy" ascii wide nocase
        $alias_4 = "illibanker" ascii wide nocase
        $alias_5 = "tinybanker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZUSY_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zusy tradecraft"
        category = "Banking_Trojan"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zusy"
        date = "2026-10-16"
    strings:
        $attrib_str = "zusy" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Zvrek (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zvrek
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZVREK_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zvrek (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zvrek"
        date = "2026-10-16"
    strings:
        $fam_name = "zvrek" ascii wide nocase
        $alias_1 = "trojan.zvrek" ascii wide nocase
        $alias_2 = "downloader.zvrek" ascii wide nocase
        $alias_3 = "win32/zvrek" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZVREK_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zvrek tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zvrek"
        date = "2026-10-16"
    strings:
        $attrib_str = "zvrek" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zvuzona (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zvuzona
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZVUZONA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zvuzona (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zvuzona"
        date = "2026-10-16"
    strings:
        $fam_name = "zvuzona" ascii wide nocase
        $alias_1 = "ransom:win32/zvuzona" ascii wide nocase
        $alias_2 = "trojan-ransom.win32.zvuzona" ascii wide nocase
        $alias_3 = "win32/zvuzona" ascii wide nocase
        $alias_4 = "zvuzona ransomware" ascii wide nocase
        $alias_5 = "ransom.zvuzona" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZVUZONA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zvuzona tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zvuzona"
        date = "2026-10-16"
    strings:
        $attrib_str = "zvuzona" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zwangi (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zwangi
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZWANGI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zwangi (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zwangi"
        date = "2026-10-16"
    strings:
        $fam_name = "zwangi" ascii wide nocase
        $alias_1 = "adware.zwangi" ascii wide nocase
        $alias_2 = "pup.zwangi" ascii wide nocase
        $alias_3 = "browserhijacker.zwangi" ascii wide nocase
        $alias_4 = "win32/zwangi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZWANGI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zwangi tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zwangi"
        date = "2026-10-16"
    strings:
        $attrib_str = "zwangi" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zxor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zxor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZXOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zxor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zxor"
        date = "2026-10-16"
    strings:
        $fam_name = "zxor" ascii wide nocase
        $alias_1 = "trojan.zxor" ascii wide nocase
        $alias_2 = "downloader.zxor" ascii wide nocase
        $alias_3 = "win32/zxor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZXOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zxor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zxor"
        date = "2026-10-16"
    strings:
        $attrib_str = "zxor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zxrloader (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zxrloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZXRLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zxrloader (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zxrloader"
        date = "2026-10-16"
    strings:
        $fam_name = "zxrloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZXRLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zxrloader tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zxrloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "zxrloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zxshell (Backdoor)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zxshell
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZXSHELL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zxshell (Backdoor)"
        category = "Backdoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zxshell"
        date = "2026-10-16"
    strings:
        $fam_name = "zxshell" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZXSHELL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zxshell tradecraft"
        category = "Backdoor"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zxshell"
        date = "2026-10-16"
    strings:
        $attrib_str = "zxshell" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Zy0Baazvyqni (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zy0baazvyqni
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZY0BAAZVYQNI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zy0Baazvyqni (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zy0baazvyqni"
        date = "2026-10-16"
    strings:
        $fam_name = "zy0baazvyqni" ascii wide nocase
        $alias_1 = "trojan.generic.zy0baazvyqni" ascii wide nocase
        $alias_2 = "malware.obfuscated" ascii wide nocase
        $alias_3 = "win32/trojan.heur" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZY0BAAZVYQNI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zy0Baazvyqni tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zy0baazvyqni"
        date = "2026-10-16"
    strings:
        $attrib_str = "zy0baazvyqni" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zygug (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zygug
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZYGUG_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zygug (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zygug"
        date = "2026-10-16"
    strings:
        $fam_name = "zygug" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZYGUG_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zygug tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zygug"
        date = "2026-10-16"
    strings:
        $attrib_str = "zygug" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Zylom (Adware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zylom
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZYLOM_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zylom (Adware)"
        category = "Adware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zylom"
        date = "2026-10-16"
    strings:
        $fam_name = "zylom" ascii wide nocase
        $alias_1 = "adware:win32/zylom" ascii wide nocase
        $alias_2 = "browsermodifier:win32/zylom" ascii wide nocase
        $alias_3 = "pua:win32/zylom" ascii wide nocase
        $alias_4 = "win32/zylom" ascii wide nocase
        $alias_5 = "zylom games toolbar" ascii wide nocase
        $alias_6 = "adware.zylom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZYLOM_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zylom tradecraft"
        category = "Adware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zylom"
        date = "2026-10-16"
    strings:
        $attrib_str = "zylom" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Zzinfor (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/zzinfor
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ZZINFOR_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Zzinfor (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zzinfor"
        date = "2026-10-16"
    strings:
        $fam_name = "zzinfor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ZZINFOR_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Zzinfor tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/zzinfor"
        date = "2026-10-16"
    strings:
        $attrib_str = "zzinfor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Redline (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/redline
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REDLINE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Redline (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redline"
        date = "2026-10-16"
    strings:
        $fam_name = "redline" ascii wide nocase
        $alias_1 = "redline stealer" ascii wide nocase
        $alias_2 = "redlinestealer" ascii wide nocase
        $alias_3 = "trojan:win32/redline" ascii wide nocase
        $alias_4 = "win32/redline.a" ascii wide nocase
        $alias_5 = "msil/redline" ascii wide nocase
        $alias_6 = "redline.c" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REDLINE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Redline tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/redline"
        date = "2026-10-16"
    strings:
        $attrib_str = "redline" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Lumma (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/lumma
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_LUMMA_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lumma (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lumma"
        date = "2026-10-16"
    strings:
        $fam_name = "lumma" ascii wide nocase
        $alias_1 = "lumma stealer" ascii wide nocase
        $alias_2 = "lummac2" ascii wide nocase
        $alias_3 = "lummastealer" ascii wide nocase
        $alias_4 = "trojan:win32/lumma" ascii wide nocase
        $alias_5 = "win32/lummastealer" ascii wide nocase
        $alias_6 = "lumma.c2" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_LUMMA_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lumma tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/lumma"
        date = "2026-10-16"
    strings:
        $attrib_str = "lumma" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Asyncrat (Rat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/asyncrat
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_ASYNCRAT_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Asyncrat (Rat)"
        category = "Rat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/asyncrat"
        date = "2026-10-16"
    strings:
        $fam_name = "asyncrat" ascii wide nocase
        $alias_1 = "asyncrat" ascii wide nocase
        $alias_2 = "async rat" ascii wide nocase
        $alias_3 = "backdoor:msil/asyncrat" ascii wide nocase
        $alias_4 = "trojan.msil.asyncrat" ascii wide nocase
        $alias_5 = "win32/asyncrat" ascii wide nocase
        $alias_6 = "asyncrat.client" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_ASYNCRAT_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Asyncrat tradecraft"
        category = "Rat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/asyncrat"
        date = "2026-10-16"
    strings:
        $attrib_str = "asyncrat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $rat_marker1 = "SetWindowsHookEx" ascii
        $rat_marker2 = "CurrentVersion\\Run" ascii wide nocase
        $shell_marker = "cmd.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($rat_marker*, $shell_marker))
}

/*
    YARA Hunting Rules for Stealc (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stealc
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STEALC_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stealc (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stealc"
        date = "2026-10-16"
    strings:
        $fam_name = "stealc" ascii wide nocase
        $alias_1 = "stealc" ascii wide nocase
        $alias_2 = "stealc stealer" ascii wide nocase
        $alias_3 = "trojan:win32/stealc" ascii wide nocase
        $alias_4 = "win32/stealc" ascii wide nocase
        $alias_5 = "trojan.stealc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STEALC_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stealc tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stealc"
        date = "2026-10-16"
    strings:
        $attrib_str = "stealc" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bumblebee (Loader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bumblebee
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BUMBLEBEE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bumblebee (Loader)"
        category = "Loader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bumblebee"
        date = "2026-10-16"
    strings:
        $fam_name = "bumblebee" ascii wide nocase
        $alias_1 = "bumblebee" ascii wide nocase
        $alias_2 = "bumblebee loader" ascii wide nocase
        $alias_3 = "trojan:win32/bumblebee" ascii wide nocase
        $alias_4 = "win32/bumblebee" ascii wide nocase
        $alias_5 = "bumblebee.loader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BUMBLEBEE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bumblebee tradecraft"
        category = "Loader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bumblebee"
        date = "2026-10-16"
    strings:
        $attrib_str = "bumblebee" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Conti (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/conti
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CONTI_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Conti (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/conti"
        date = "2026-10-16"
    strings:
        $fam_name = "conti" ascii wide nocase
        $alias_1 = "conti ransomware" ascii wide nocase
        $alias_2 = "conti.news" ascii wide nocase
        $alias_3 = "trojan.ransom.conti" ascii wide nocase
        $alias_4 = "win32/conti" ascii wide nocase
        $alias_5 = "wizard spider conti" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CONTI_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Conti tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/conti"
        date = "2026-10-16"
    strings:
        $attrib_str = "conti" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Revil (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/revil
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_REVIL_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Revil (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revil"
        date = "2026-10-16"
    strings:
        $fam_name = "revil" ascii wide nocase
        $alias_1 = "sodinokibi" ascii wide nocase
        $alias_2 = "sodin" ascii wide nocase
        $alias_3 = "revil ransomware" ascii wide nocase
        $alias_4 = "trojan.ransom.sodinokibi" ascii wide nocase
        $alias_5 = "win32/sodinokibi" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_REVIL_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Revil tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/revil"
        date = "2026-10-16"
    strings:
        $attrib_str = "revil" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Darkside (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/darkside
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_DARKSIDE_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Darkside (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkside"
        date = "2026-10-16"
    strings:
        $fam_name = "darkside" ascii wide nocase
        $alias_1 = "darkside ransomware" ascii wide nocase
        $alias_2 = "darkside.leaks" ascii wide nocase
        $alias_3 = "trojan.ransom.darkside" ascii wide nocase
        $alias_4 = "win32/darkside" ascii wide nocase
        $alias_5 = "blackmatter-precursor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_DARKSIDE_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Darkside tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/darkside"
        date = "2026-10-16"
    strings:
        $attrib_str = "darkside" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Clop (Ransomware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/clop
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CLOP_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Clop (Ransomware)"
        category = "Ransomware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clop"
        date = "2026-10-16"
    strings:
        $fam_name = "clop" ascii wide nocase
        $alias_1 = "cl0p" ascii wide nocase
        $alias_2 = "clop ransomware" ascii wide nocase
        $alias_3 = "cryptomix clop" ascii wide nocase
        $alias_4 = "ta505 clop" ascii wide nocase
        $alias_5 = "lace tempest" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CLOP_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Clop tradecraft"
        category = "Ransomware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/clop"
        date = "2026-10-16"
    strings:
        $attrib_str = "clop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $ransom_marker1 = "vssadmin" ascii wide nocase
        $ransom_marker2 = "delete shadows" ascii wide nocase
        $crypto_marker = "AES" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (2 of ($ransom_marker*) or $crypto_marker)
}

/*
    YARA Hunting Rules for Stuxnet (Advanced_Threat)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/stuxnet
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_STUXNET_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Stuxnet (Advanced_Threat)"
        category = "Advanced_Threat"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stuxnet"
        date = "2026-10-16"
    strings:
        $fam_name = "stuxnet" ascii wide nocase
        $alias_1 = "rootkit.win32.stuxnet" ascii wide nocase
        $alias_2 = "w32.stuxnet" ascii wide nocase
        $alias_3 = "operation olympic games" ascii wide nocase
        $alias_4 = "stuxnet industrial worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_STUXNET_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Stuxnet tradecraft"
        category = "Advanced_Threat"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/stuxnet"
        date = "2026-10-16"
    strings:
        $attrib_str = "stuxnet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Pegasus (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/pegasus
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_PEGASUS_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Pegasus (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pegasus"
        date = "2026-10-16"
    strings:
        $fam_name = "pegasus" ascii wide nocase
        $alias_1 = "pegasus spyware" ascii wide nocase
        $alias_2 = "nso group pegasus" ascii wide nocase
        $alias_3 = "chrysaor (android variant)" ascii wide nocase
        $alias_4 = "forcedentry spyware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_PEGASUS_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Pegasus tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/pegasus"
        date = "2026-10-16"
    strings:
        $attrib_str = "pegasus" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Raccoon (Infostealer)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/raccoon
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_RACCOON_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Raccoon (Infostealer)"
        category = "Infostealer"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/raccoon"
        date = "2026-10-16"
    strings:
        $fam_name = "raccoon" ascii wide nocase
        $alias_1 = "raccoon stealer" ascii wide nocase
        $alias_2 = "recordbreaker" ascii wide nocase
        $alias_3 = "trojan:win32/raccoon" ascii wide nocase
        $alias_4 = "win32/raccoonstealer" ascii wide nocase
        $alias_5 = "race stealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_RACCOON_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Raccoon tradecraft"
        category = "Infostealer"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/raccoon"
        date = "2026-10-16"
    strings:
        $attrib_str = "raccoon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $steal_marker1 = "Login Data" ascii wide nocase
        $steal_marker2 = "Cookies" ascii wide nocase
        $vault_marker = "CryptUnprotectData" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and (1 of ($steal_marker*) or $vault_marker)
}

/*
    YARA Hunting Rules for Bazarloader (Loader)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/bazarloader
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BAZARLOADER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Bazarloader (Loader)"
        category = "Loader"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bazarloader"
        date = "2026-10-16"
    strings:
        $fam_name = "bazarloader" ascii wide nocase
        $alias_1 = "bazarbackdoor" ascii wide nocase
        $alias_2 = "bazaloader" ascii wide nocase
        $alias_3 = "trojan:win32/bazarloader" ascii wide nocase
        $alias_4 = "win32/bazarbackdoor" ascii wide nocase
        $alias_5 = "wizard spider bazar" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BAZARLOADER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Bazarloader tradecraft"
        category = "Loader"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/bazarloader"
        date = "2026-10-16"
    strings:
        $attrib_str = "bazarloader" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Sasser (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/sasser
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_SASSER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Sasser (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sasser"
        date = "2026-10-16"
    strings:
        $fam_name = "sasser" ascii wide nocase
        $alias_1 = "w32.sasser" ascii wide nocase
        $alias_2 = "worm.win32.sasser" ascii wide nocase
        $alias_3 = "win32/sasser.a" ascii wide nocase
        $alias_4 = "sasser worm" ascii wide nocase
        $alias_5 = "w32/sasser.worm" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_SASSER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Sasser tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/sasser"
        date = "2026-10-16"
    strings:
        $attrib_str = "sasser" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Blaster (Worm)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/blaster
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_BLASTER_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Blaster (Worm)"
        category = "Worm"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blaster"
        date = "2026-10-16"
    strings:
        $fam_name = "blaster" ascii wide nocase
        $alias_1 = "msblast" ascii wide nocase
        $alias_2 = "lovsan" ascii wide nocase
        $alias_3 = "poosan" ascii wide nocase
        $alias_4 = "w32.blaster.worm" ascii wide nocase
        $alias_5 = "win32/blaster" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_BLASTER_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Blaster tradecraft"
        category = "Worm"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/blaster"
        date = "2026-10-16"
    strings:
        $attrib_str = "blaster" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}

/*
    YARA Hunting Rules for Candiru (Spyware)
    Source: SystemHelpDesk Malware Families Catalog
    Reference: https://malware-families-catalog.systemhelpdesk.com/families/candiru
    License: Apache-2.0
    Generated: 2026-10-16
*/

rule MALWARE_WIN_CANDIRU_T1_ARTIFACT
{
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Candiru (Spyware)"
        category = "Spyware"
        tier = "T1 - Primitive Artifact"
        confidence = "Medium (Fast Triage)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/candiru"
        date = "2026-10-16"
    strings:
        $fam_name = "candiru" ascii wide nocase
        $alias_1 = "candiru spyware" ascii wide nocase
        $alias_2 = "devilstongue" ascii wide nocase
        $alias_3 = "saito tech" ascii wide nocase
        $alias_4 = "kandiru" ascii wide nocase
        $alias_5 = "caramel spyware" ascii wide nocase
        $alias_6 = "taveta" ascii wide nocase
        $alias_7 = "grindavik solutions" ascii wide nocase
        $alias_8 = "sherlock (internal code)" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

rule MALWARE_WIN_CANDIRU_T3_ATTRIBUTION
{
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Candiru tradecraft"
        category = "Spyware"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpDesk Threat Research Desk"
        reference = "https://malware-families-catalog.systemhelpdesk.com/families/candiru"
        date = "2026-10-16"
    strings:
        $attrib_str = "candiru" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker1 = "http" ascii nocase
        $net_marker2 = "POST" ascii
        $net_marker3 = "User-Agent:" ascii nocase
        $generic_marker1 = "CreateProcess" ascii
        $generic_marker2 = "VirtualAlloc" ascii
    condition:
        uint16(0) == 0x5a4d and $attrib_str and 1 of ($generic_marker*)
}