deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_GUID_BrowserGhost
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/QAX-A-Team/BrowserGhost

Pattern signatures:
$typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
        and not pe.is_dll()

Full rule:
rule HKTL_NET_GUID_BrowserGhost {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/QAX-A-Team/BrowserGhost"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        modified = "2025-08-15"
        id = "adcc5d12-c393-5708-ae0b-a85f2187c881"
    strings:
        $typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
        and not pe.is_dll()
}
YARA Detection Rule: HKTL_NET_GUID_SharpShot
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/tothi/SharpShot

Pattern signatures:
$typelibguid0lo = "057aef75-861b-4e4b-a372-cfbd8322c8e1" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpShot {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/tothi/SharpShot"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "9d59cd53-53b1-57db-b391-eee4dd6feec0"
    strings:
        $typelibguid0lo = "057aef75-861b-4e4b-a372-cfbd8322c8e1" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Offensive__NET
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/mrjamiebowman/Offensive-.NET

Pattern signatures:
$typelibguid0lo = "11fe5fae-b7c1-484a-b162-d5578a802c9c" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Offensive__NET {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/mrjamiebowman/Offensive-.NET"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "b98495fb-0338-5042-a7ce-d117204eb91e"
    strings:
        $typelibguid0lo = "11fe5fae-b7c1-484a-b162-d5578a802c9c" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_RuralBishop
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/rasta-mouse/RuralBishop

Pattern signatures:
$typelibguid0lo = "fe4414d9-1d7e-4eeb-b781-d278fe7a5619" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_RuralBishop {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/RuralBishop"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "8fd89465-1ecc-5eda-b2ab-273172ad945d"
    strings:
        $typelibguid0lo = "fe4414d9-1d7e-4eeb-b781-d278fe7a5619" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_DeviceGuardBypasses
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/tyranid/DeviceGuardBypasses

Pattern signatures:
$typelibguid0lo = "f318466d-d310-49ad-a967-67efbba29898" ascii wide
        $typelibguid1lo = "3705800f-1424-465b-937d-586e3a622a4f" ascii wide
        $typelibguid2lo = "256607c2-4126-4272-a2fa-a1ffc0a734f0" ascii wide
        $typelibguid3lo = "4e6ceea1-f266-401c-b832-f91432d46f42" ascii wide
        $typelibguid4lo = "1e6e9b03-dd5f-4047-b386-af7a7904f884" ascii wide
        $typelibguid5lo = "d85e3601-0421-4efa-a479-f3370c0498fd" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_DeviceGuardBypasses {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/tyranid/DeviceGuardBypasses"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "3790faac-b5be-5999-b35f-71a2ef02b6ed"
    strings:
        $typelibguid0lo = "f318466d-d310-49ad-a967-67efbba29898" ascii wide
        $typelibguid1lo = "3705800f-1424-465b-937d-586e3a622a4f" ascii wide
        $typelibguid2lo = "256607c2-4126-4272-a2fa-a1ffc0a734f0" ascii wide
        $typelibguid3lo = "4e6ceea1-f266-401c-b832-f91432d46f42" ascii wide
        $typelibguid4lo = "1e6e9b03-dd5f-4047-b386-af7a7904f884" ascii wide
        $typelibguid5lo = "d85e3601-0421-4efa-a479-f3370c0498fd" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_AMSI_Handler
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/two06/AMSI_Handler

Pattern signatures:
$typelibguid0lo = "d829426c-986c-40a4-8ee2-58d14e090ef2" ascii wide
        $typelibguid1lo = "86[PII_REDACTED]-43fd-98b5-859828b072be" ascii wide
        $typelibguid2lo = "1043649f-18e1-41c4-ae8d-ac4d9a86c2fc" ascii wide
        $typelibguid3lo = "1d920b03-c537-4659-9a8c-09fb1d615e98" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_AMSI_Handler {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/two06/AMSI_Handler"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "40768acf-fa9e-531a-83fd-187814ddc2d4"
    strings:
        $typelibguid0lo = "d829426c-986c-40a4-8ee2-58d14e090ef2" ascii wide
        $typelibguid1lo = "86[PII_REDACTED]-43fd-98b5-859828b072be" ascii wide
        $typelibguid2lo = "1043649f-18e1-41c4-ae8d-ac4d9a86c2fc" ascii wide
        $typelibguid3lo = "1d920b03-c537-4659-9a8c-09fb1d615e98" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_RAT_TelegramSpyBot
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/SebastianEPH/RAT.TelegramSpyBot

Pattern signatures:
$typelibguid0lo = "8653fa88-9655-440e-b534-26c3c760a0d3" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_RAT_TelegramSpyBot {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/SebastianEPH/RAT.TelegramSpyBot"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "57d22201-a051-5040-927c-30da3fc684fd"
    strings:
        $typelibguid0lo = "8653fa88-9655-440e-b534-26c3c760a0d3" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_TheHackToolBoxTeek
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/teeknofil/TheHackToolBoxTeek

Pattern signatures:
$typelibguid0lo = "2aa8c254-b3b3-469c-b0c9-dcbe1dd101c0" ascii wide
        $typelibguid1lo = "afeff505-14c1-4ecf-b714-abac4fbd48e7" ascii wide
        $typelibguid2lo = "4cf42167-a5cf-4b2d-85b4-8e764c08d6b3" ascii wide
        $typelibguid3lo = "118a90b7-598a-4cfc-859e-8013c8b9339c" ascii wide
        $typelibguid4lo = "3075dd9a-4283-4d38-a25e-9f9845e5adcb" ascii wide
        $typelibguid5lo = "295655e8-2348-4700-9ebc-aa57df54887e" ascii wide
        $typelibguid6lo = "74efe601-9a93-46c3-932e-b80ab6570e42" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_TheHackToolBoxTeek {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/teeknofil/TheHackToolBoxTeek"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "ad8cf2c8-f70e-5f46-92fa-46e1fa5e683c"
    strings:
        $typelibguid0lo = "2aa8c254-b3b3-469c-b0c9-dcbe1dd101c0" ascii wide
        $typelibguid1lo = "afeff505-14c1-4ecf-b714-abac4fbd48e7" ascii wide
        $typelibguid2lo = "4cf42167-a5cf-4b2d-85b4-8e764c08d6b3" ascii wide
        $typelibguid3lo = "118a90b7-598a-4cfc-859e-8013c8b9339c" ascii wide
        $typelibguid4lo = "3075dd9a-4283-4d38-a25e-9f9845e5adcb" ascii wide
        $typelibguid5lo = "295655e8-2348-4700-9ebc-aa57df54887e" ascii wide
        $typelibguid6lo = "74efe601-9a93-46c3-932e-b80ab6570e42" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_USBTrojan
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/mashed-potatoes/USBTrojan

Pattern signatures:
$typelibguid0lo = "4eee900e-adc5-46a7-8d7d-873fd6aea83e" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_USBTrojan {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/mashed-potatoes/USBTrojan"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "d25c9033-13e8-5fc9-8561-f8862cca39b8"
    strings:
        $typelibguid0lo = "4eee900e-adc5-46a7-8d7d-873fd6aea83e" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_IIS_backdoor
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/WBGlIl/IIS_backdoor

Pattern signatures:
$typelibguid0lo = "3fda4aa9-6fc1-473f-9048-7edc058c4f65" ascii wide
        $typelibguid1lo = "73ca4159-5d13-4a27-8965-d50c41ab203c" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_IIS_backdoor {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/WBGlIl/IIS_backdoor"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "44264dd9-f8e9-5a60-847f-94378e07a327"
    strings:
        $typelibguid0lo = "3fda4aa9-6fc1-473f-9048-7edc058c4f65" ascii wide
        $typelibguid1lo = "73ca4159-5d13-4a27-8965-d50c41ab203c" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_ShellGen
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/jasondrawdy/ShellGen

Pattern signatures:
$typelibguid0lo = "c6894882-d29d-4ae1-aeb7-7d0a9b915013" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_ShellGen {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jasondrawdy/ShellGen"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "538a4f12-5020-5c76-9208-363f435ed9a9"
    strings:
        $typelibguid0lo = "c6894882-d29d-4ae1-aeb7-7d0a9b915013" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Mass_RAT
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/NYAN-x-CAT/Mass-RAT

Pattern signatures:
$typelibguid0lo = "6c43a753-9565-48b2-a372-4210bb1e0d75" ascii wide
        $typelibguid1lo = "92ba2a7e-c198-4d43-929e-1cfe54b64d95" ascii wide
        $typelibguid2lo = "4cb9bbee-fb92-44fa-a427-b7245befc2f3" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Mass_RAT {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/Mass-RAT"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "90b742da-6fd7-5c72-96cf-7a37a3e5d808"
    strings:
        $typelibguid0lo = "6c43a753-9565-48b2-a372-4210bb1e0d75" ascii wide
        $typelibguid1lo = "92ba2a7e-c198-4d43-929e-1cfe54b64d95" ascii wide
        $typelibguid2lo = "4cb9bbee-fb92-44fa-a427-b7245befc2f3" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Browser_ExternalC2
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/mdsecactivebreach/Browser-ExternalC2

Pattern signatures:
$typelibguid0lo = "10a730cd-9517-42d5-b3e3-a2383515cca9" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Browser_ExternalC2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/mdsecactivebreach/Browser-ExternalC2"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "8c309522-90e7-5f5a-b456-3a472756d397"
    strings:
        $typelibguid0lo = "10a730cd-9517-42d5-b3e3-a2383515cca9" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_OffensivePowerShellTasking
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/leechristensen/OffensivePowerShellTasking

Pattern signatures:
$typelibguid0lo = "d432c332-3b48-4d06-bedb-462e264e6688" ascii wide
        $typelibguid1lo = "5796276f-1c7a-4d7b-a089-550a8c19d0e8" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_OffensivePowerShellTasking {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/leechristensen/OffensivePowerShellTasking"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "d221e24d-a2ef-51e2-95bf-4b91b438d9cf"
    strings:
        $typelibguid0lo = "d432c332-3b48-4d06-bedb-462e264e6688" ascii wide
        $typelibguid1lo = "5796276f-1c7a-4d7b-a089-550a8c19d0e8" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_DoHC2
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/SpiderLabs/DoHC2

Pattern signatures:
$typelibguid0lo = "9877a948-2142-4094-98de-e0fbb1bc4062" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_DoHC2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/SpiderLabs/DoHC2"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "0bb38f10-ca5c-5c18-97c9-540b6367d150"
    strings:
        $typelibguid0lo = "9877a948-2142-4094-98de-e0fbb1bc4062" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SyscallPOC
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/SolomonSklash/SyscallPOC

Pattern signatures:
$typelibguid0lo = "1e54637b-c887-42a9-af6a-b4bd4e28cda9" ascii wide
        $typelibguid1lo = "198d5599-d9fc-4a74-87f4[PII_REDACTED]ad" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SyscallPOC {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/SolomonSklash/SyscallPOC"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "1ed5e226-0dcd-5397-b5e8-41f8a14981a1"
    strings:
        $typelibguid0lo = "1e54637b-c887-42a9-af6a-b4bd4e28cda9" ascii wide
        $typelibguid1lo = "198d5599-d9fc-4a74-87f4[PII_REDACTED]ad" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Pen_Test_Tools
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/awillard1/Pen-Test-Tools

Pattern signatures:
$typelibguid0lo = "922e7fdc-33bf-48de-bc26-a81f85462115" ascii wide
        $typelibguid1lo = "ad5205dd-174d-4332-96d9-98b076d6fd82" ascii wide
        $typelibguid2lo = "b67e7550-f00e-48b3-ab9b-4332b1254a86" ascii wide
        $typelibguid3lo = "5e95120e-b002-4495-90a1-cd3aab2a24dd" ascii wide
        $typelibguid4lo = "295017f2-dc31-4a87-863d-0b9956c2b55a" ascii wide
        $typelibguid5lo = "abbaa2f7-1452-43a6-b98e-10b2c8c2ba46" ascii wide
        $typelibguid6lo = "a4043d4c-167b-4326-8be4[PII_REDACTED]82" ascii wide
        $typelibguid7lo = "51abfd75-b179-496e-86db-62ee2a8de90d" ascii wide
        $typelibguid8lo = "a06da7f8-f87e-4065-81d8-abc33cb547f8" ascii wide
        $typelibguid9lo = "ee[PII_REDACTED]-49a1-b08b-1f0b0b33d6ef" ascii wide
        $typelibguid10lo = "9780da65-7e25-412e-9aa1-f77d828819d6" ascii wide
        $typelibguid11lo = "7913fe95-3ad5-41f5-bf7f-e28f080724fe" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Pen_Test_Tools {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/awillard1/Pen-Test-Tools"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "00fb98a9-e615-5fb6-a555-4326b93e2c24"
    strings:
        $typelibguid0lo = "922e7fdc-33bf-48de-bc26-a81f85462115" ascii wide
        $typelibguid1lo = "ad5205dd-174d-4332-96d9-98b076d6fd82" ascii wide
        $typelibguid2lo = "b67e7550-f00e-48b3-ab9b-4332b1254a86" ascii wide
        $typelibguid3lo = "5e95120e-b002-4495-90a1-cd3aab2a24dd" ascii wide
        $typelibguid4lo = "295017f2-dc31-4a87-863d-0b9956c2b55a" ascii wide
        $typelibguid5lo = "abbaa2f7-1452-43a6-b98e-10b2c8c2ba46" ascii wide
        $typelibguid6lo = "a4043d4c-167b-4326-8be4[PII_REDACTED]82" ascii wide
        $typelibguid7lo = "51abfd75-b179-496e-86db-62ee2a8de90d" ascii wide
        $typelibguid8lo = "a06da7f8-f87e-4065-81d8-abc33cb547f8" ascii wide
        $typelibguid9lo = "ee[PII_REDACTED]-49a1-b08b-1f0b0b33d6ef" ascii wide
        $typelibguid10lo = "9780da65-7e25-412e-9aa1-f77d828819d6" ascii wide
        $typelibguid11lo = "7913fe95-3ad5-41f5-bf7f-e28f080724fe" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}