deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_GUID_Povlsomware
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/povlteksttv/Povlsomware

Pattern signatures:
$typelibguid0lo = "fe0d5aa7-538f-42f6-9ece-b141560f7781" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Povlsomware {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/povlteksttv/Povlsomware"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "0eba43d2-b415-5e72-9677-4a3238ff7c34"
    strings:
        $typelibguid0lo = "fe0d5aa7-538f-42f6-9ece-b141560f7781" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_RunShellcode
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/zerosum0x0/RunShellcode

Pattern signatures:
$typelibguid0lo = "a3ec18a3-674c-4131-a7f5-acbed034b819" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_RunShellcode {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/zerosum0x0/RunShellcode"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "249da967-68b0-59b1-b414-4eb4fe67b8f3"
    strings:
        $typelibguid0lo = "a3ec18a3-674c-4131-a7f5-acbed034b819" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpLoginPrompt
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/shantanu561993/SharpLoginPrompt

Pattern signatures:
$typelibguid0lo = "c12e69cd-78a0-4960-af7e-88cbd794af97" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpLoginPrompt {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/shantanu561993/SharpLoginPrompt"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "e9a493d9-21b6-5ff1-9e5e-e8fbacc34c0c"
    strings:
        $typelibguid0lo = "c12e69cd-78a0-4960-af7e-88cbd794af97" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Adamantium_Thief
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/LimerBoy/Adamantium-Thief

Pattern signatures:
$typelibguid0lo = "e6104bc9-fea9-4ee9-b919-28156c1f2ede" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Adamantium_Thief {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/LimerBoy/Adamantium-Thief"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "82225b2e-ab4a-50b8-a3fd-7ad4947d052e"
    strings:
        $typelibguid0lo = "e6104bc9-fea9-4ee9-b919-28156c1f2ede" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_PSByPassCLM
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/padovah4ck/PSByPassCLM

Pattern signatures:
$typelibguid0lo = "46[PII_REDACTED]-4d75-81fd-eb3b483f2662" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_PSByPassCLM {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/padovah4ck/PSByPassCLM"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "dad6729f-3d96-5d2d-b72c-a96d1a3eae74"
    strings:
        $typelibguid0lo = "46[PII_REDACTED]-4d75-81fd-eb3b483f2662" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_physmem2profit
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/FSecureLABS/physmem2profit

Pattern signatures:
$typelibguid0lo = "814708c9-2320-42d2-a45f-31e42da06a94" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_physmem2profit {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/FSecureLABS/physmem2profit"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "75a27970-c469-53da-b0c3-b3d0faea0b6f"
    strings:
        $typelibguid0lo = "814708c9-2320-42d2-a45f-31e42da06a94" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_NoAmci
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/med0x2e/NoAmci

Pattern signatures:
$typelibguid0lo = "352e80ec-72a5-4aa6-aabe-4f9a20393e8e" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_NoAmci {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/med0x2e/NoAmci"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "5fab1551-9d35-53cf-a04f-c[PII_REDACTED]"
    strings:
        $typelibguid0lo = "352e80ec-72a5-4aa6-aabe-4f9a20393e8e" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpBlock
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/CCob/SharpBlock

Pattern signatures:
$typelibguid0lo = "3cf25e04-27e4-4d19-945e-dadc37c81152" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpBlock {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/CCob/SharpBlock"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "b84538da-1b0e-50c7-abfa-e93d6de5a49b"
    strings:
        $typelibguid0lo = "3cf25e04-27e4-4d19-945e-dadc37c81152" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_nopowershell
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/bitsadmin/nopowershell

Pattern signatures:
$typelibguid0lo = "555ad0ac-1fdb-4016-8257-170a74cb2f55" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_nopowershell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/bitsadmin/nopowershell"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "0fd7496b-e34f-51f7-9270-ad424ed6a7a8"
    strings:
        $typelibguid0lo = "555ad0ac-1fdb-4016-8257-170a74cb2f55" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_LimeLogger
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/NYAN-x-CAT/LimeLogger

Pattern signatures:
$typelibguid0lo = "068d14ef-f0a1-4f9d-8e27-58b4317830c6" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_LimeLogger {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/LimeLogger"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "0798f01b-76b7-5c4d-9ddb-5e377b86f8b9"
    strings:
        $typelibguid0lo = "068d14ef-f0a1-4f9d-8e27-58b4317830c6" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_AggressorScripts
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/harleyQu1nn/AggressorScripts

Pattern signatures:
$typelibguid0lo = "afd1ff09-2632-4087-a30c-43591f32e4e8" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_AggressorScripts {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/harleyQu1nn/AggressorScripts"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "d5903db5-010b-5b9d-8a5b-5d61aec52e7a"
    strings:
        $typelibguid0lo = "afd1ff09-2632-4087-a30c-43591f32e4e8" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Gopher
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/EncodeGroup/Gopher

Pattern signatures:
$typelibguid0lo = "b5[PII_REDACTED]-49ce-9aca-1bc43df1e234" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Gopher {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/EncodeGroup/Gopher"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "e3[PII_REDACTED]-584d-8237-f377ec995149"
    strings:
        $typelibguid0lo = "b5[PII_REDACTED]-49ce-9aca-1bc43df1e234" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_AVIator
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/Ch0pin/AVIator

Pattern signatures:
$typelibguid0lo = "4885a4a3-4dfa-486c-b378-ae94a221661a" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_AVIator {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Ch0pin/AVIator"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "52acd520-52aa-5bb9-ab3b-66a940aa5f5a"
    strings:
        $typelibguid0lo = "4885a4a3-4dfa-486c-b378-ae94a221661a" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_njCrypter
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/0xPh0enix/njCrypter

Pattern signatures:
$typelibguid0lo = "8a87b003-4b43-467b-a509-0c8be05bf5a5" ascii wide
        $typelibguid1lo = "80b13bff-24a5-4193-8e51-c62a414060ec" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_njCrypter {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xPh0enix/njCrypter"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "c30c8323-9418-521a-a4fc-6be0113b99b5"
    strings:
        $typelibguid0lo = "8a87b003-4b43-467b-a509-0c8be05bf5a5" ascii wide
        $typelibguid1lo = "80b13bff-24a5-4193-8e51-c62a414060ec" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpMiniDump
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/b4rtik/SharpMiniDump

Pattern signatures:
$typelibguid0lo = "6ffccf81-6c3c-4d3f-b15f-35a86d0b497f" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpMiniDump {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/b4rtik/SharpMiniDump"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "e91e6711-d992-5a8a-97e6-1ed7847f38a4"
    strings:
        $typelibguid0lo = "6ffccf81-6c3c-4d3f-b15f-35a86d0b497f" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_CinaRAT
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/wearelegal/CinaRAT

Pattern signatures:
$typelibguid0lo = "8586f5b1-2ef4-4f35-bd45-c6206fdc0ebc" ascii wide
        $typelibguid1lo = "fe184ab5-f153-4179-9bf5-50523987cf1f" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_CinaRAT {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/wearelegal/CinaRAT"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "c6b4c919-0fc6-5096-b29b-963142a2c831"
    strings:
        $typelibguid0lo = "8586f5b1-2ef4-4f35-bd45-c6206fdc0ebc" ascii wide
        $typelibguid1lo = "fe184ab5-f153-4179-9bf5-50523987cf1f" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_ToxicEye
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/LimerBoy/ToxicEye

Pattern signatures:
$typelibguid0lo = "1bcfe538-14f4-4beb-9a3f-3f[PII_REDACTED]" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_ToxicEye {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/LimerBoy/ToxicEye"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "0b7b62ce-9c24-5d81-8d87-22f6e461a62b"
    strings:
        $typelibguid0lo = "1bcfe538-14f4-4beb-9a3f-3f[PII_REDACTED]" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Disable_Windows_Defender
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/NYAN-x-CAT/Disable-Windows-Defender

Pattern signatures:
$typelibguid0lo = "501e3fdc-575d-492e-90bc-703fb6280ee2" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Disable_Windows_Defender {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/Disable-Windows-Defender"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "9a673427-e66e-594b-942a-64a2272319f3"
    strings:
        $typelibguid0lo = "501e3fdc-575d-492e-90bc-703fb6280ee2" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_DInvoke_PoC
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/dtrizna/DInvoke_PoC

Pattern signatures:
$typelibguid0lo = "5a869ab2-291a-49e6-a1b7-0d0f051bef0e" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_DInvoke_PoC {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/dtrizna/DInvoke_PoC"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"
    strings:
        $typelibguid0lo = "5a869ab2-291a-49e6-a1b7-0d0f051bef0e" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_ReverseShell
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/chango77747/ReverseShell

Pattern signatures:
$typelibguid0lo = "980109e4-c988-47f9-b2b3-88d63fababdc" ascii wide
        $typelibguid1lo = "8abe8da1-457e-4933-a40d-0958c8925985" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_ReverseShell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/chango77747/ReverseShell"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "876932d5-a65d-5230-9cb8-24038ad8af0d"
    strings:
        $typelibguid0lo = "980109e4-c988-47f9-b2b3-88d63fababdc" ascii wide
        $typelibguid1lo = "8abe8da1-457e-4933-a40d-0958c8925985" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpC2
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/SharpC2/SharpC2

Pattern signatures:
$typelibguid0lo = "62b9ee4f-1436-4098-9bc1-dd61b42d8b81" ascii wide
        $typelibguid1lo = "d2f17a91-eb2d-4373-90bf-a26e46c68f76" ascii wide
        $typelibguid2lo = "a9db9fcc-7502-42cd-81ec-3cd66f511346" ascii wide
        $typelibguid3lo = "ca6cc2ee-75fd-4f00-b687-917fa55a4fae" ascii wide
        $typelibguid4lo = "a1167b68-446b-4c0c-a8b8-2a7278b67511" ascii wide
        $typelibguid5lo = "4d8c2a88-1da5-4abe-8[PII_REDACTED]d7cf1" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpC2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/SharpC2/SharpC2"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-13"
        modified = "2025-08-15"
        id = "2ed6d74e-2b95-5c70-807a-4da5e62f5853"
    strings:
        $typelibguid0lo = "62b9ee4f-1436-4098-9bc1-dd61b42d8b81" ascii wide
        $typelibguid1lo = "d2f17a91-eb2d-4373-90bf-a26e46c68f76" ascii wide
        $typelibguid2lo = "a9db9fcc-7502-42cd-81ec-3cd66f511346" ascii wide
        $typelibguid3lo = "ca6cc2ee-75fd-4f00-b687-917fa55a4fae" ascii wide
        $typelibguid4lo = "a1167b68-446b-4c0c-a8b8-2a7278b67511" ascii wide
        $typelibguid5lo = "4d8c2a88-1da5-4abe-8[PII_REDACTED]d7cf1" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}