deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_GUID_neo_ConfuserEx
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/XenocodeRCE/neo-ConfuserEx

Pattern signatures:
$typelibguid0 = "e98490bb-63e5-492d-b14e-304de928f81a" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_neo_ConfuserEx {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/XenocodeRCE/neo-ConfuserEx"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "e98490bb-63e5-492d-b14e-304de928f81a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpAllowedToAct
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/pkb1s/SharpAllowedToAct

Pattern signatures:
$typelibguid0 = "dac5448a-4ad1-490a-846a-18e4e3e0cf9a" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpAllowedToAct {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/pkb1s/SharpAllowedToAct"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "dac5448a-4ad1-490a-846a-18e4e3e0cf9a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SuperSQLInjectionV1
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/shack2/SuperSQLInjectionV1

Pattern signatures:
$typelibguid0 = "d5688068-fc89-467d-913f-037a785caca7" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SuperSQLInjectionV1 {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/shack2/SuperSQLInjectionV1"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "d5688068-fc89-467d-913f-037a785caca7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_ADSearch
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/tomcarver16/ADSearch

Pattern signatures:
$typelibguid0 = "4da5f1b7-8936-4413-91f7-57d6e072b4a7" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_ADSearch {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/tomcarver16/ADSearch"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "4da5f1b7-8936-4413-91f7-57d6e072b4a7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_privilege_escalation_awesome_scripts_suite
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite

Pattern signatures:
$typelibguid0 = "1928358e-a64b-493f-a741-ae8e3d029374" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_privilege_escalation_awesome_scripts_suite {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "1928358e-a64b-493f-a741-ae8e3d029374" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_CVE_2020_1206_POC
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/ZecOps/CVE-2020-1206-POC

Pattern signatures:
$typelibguid0 = "3523ca04-a12d-4b40-8837-1a1d28ef96de" ascii nocase wide
        $typelibguid1 = "d3a2f24a-ddc6-4548-9b3d-470e70dbcaab" ascii nocase wide
        $typelibguid2 = "fb30ee05-4a35-45f7-9a0a-829aec7e47d9" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_CVE_2020_1206_POC {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/ZecOps/CVE-2020-1206-POC"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "3523ca04-a12d-4b40-8837-1a1d28ef96de" ascii nocase wide
        $typelibguid1 = "d3a2f24a-ddc6-4548-9b3d-470e70dbcaab" ascii nocase wide
        $typelibguid2 = "fb30ee05-4a35-45f7-9a0a-829aec7e47d9" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_DInvoke
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/TheWover/DInvoke

Pattern signatures:
$typelibguid0 = "b77fdab5-207c-4cdb-b1aa-348505c54229" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_DInvoke {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/TheWover/DInvoke"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "b77fdab5-207c-4cdb-b1aa-348505c54229" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpChisel
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/shantanu561993/SharpChisel

Pattern signatures:
$typelibguid0 = "f5f21e2d-eb7e-4146-a7e1-371fd08d6762" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpChisel {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/shantanu561993/SharpChisel"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "f5f21e2d-eb7e-4146-a7e1-371fd08d6762" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpScribbles
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/V1V1/SharpScribbles

Pattern signatures:
$typelibguid0 = "aa61a166-31ef-429d-a971-ca654cd18c3b" ascii nocase wide
        $typelibguid1 = "0dc1b824-c6e7-4881-8788-35aecb34d227" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpScribbles {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/V1V1/SharpScribbles"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "aa61a166-31ef-429d-a971-ca654cd18c3b" ascii nocase wide
        $typelibguid1 = "0dc1b824-c6e7-4881-8788-35aecb34d227" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpReg
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/jnqpblc/SharpReg

Pattern signatures:
$typelibguid0 = "8ef25b00-ed6a-4464-bdec-17281a4aa52f" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpReg {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/jnqpblc/SharpReg"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "8ef25b00-ed6a-4464-bdec-17281a4aa52f" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_MemeVM
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/TobitoFatitoRE/MemeVM

Pattern signatures:
$typelibguid0 = "ef18f7f2-1f03-481c-98f9-4a18a2f12c11" ascii nocase wide
        $typelibguid1 = "77b2c83b-ca34-4738-9384-c52f0121647c" ascii nocase wide
        $typelibguid2 = "14d5d12e-9a32-4516-904e-df[PII_REDACTED]" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_MemeVM {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/TobitoFatitoRE/MemeVM"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "ef18f7f2-1f03-481c-98f9-4a18a2f12c11" ascii nocase wide
        $typelibguid1 = "77b2c83b-ca34-4738-9384-c52f0121647c" ascii nocase wide
        $typelibguid2 = "14d5d12e-9a32-4516-904e-df[PII_REDACTED]" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpDir
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/jnqpblc/SharpDir

Pattern signatures:
$typelibguid0 = "c7a07532-12a3-4f6a-a342-161bb060b789" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpDir {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/jnqpblc/SharpDir"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "c7a07532-12a3-4f6a-a342-161bb060b789" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_AtYourService
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/mitchmoser/AtYourService

Pattern signatures:
$typelibguid0 = "bc72386f-8b4c-44de-99b7-b06a8de3ce3f" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_AtYourService {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/mitchmoser/AtYourService"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "bc72386f-8b4c-44de-99b7-b06a8de3ce3f" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_LockLess
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/GhostPack/LockLess

Pattern signatures:
$typelibguid0 = "a91421cb-7909-4383-ba43-c2992bbbac22" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_LockLess {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/LockLess"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "a91421cb-7909-4383-ba43-c2992bbbac22" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_EasyNet
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/TheWover/EasyNet

Pattern signatures:
$typelibguid0 = "3097d856-25c2-42c9-8d59-2cdad8e8ea12" ascii nocase wide
        $typelibguid1 = "ba33f716-91e0-4cf7-b9bd-b4d558f9a173" ascii nocase wide
        $typelibguid2 = "37d6dd3f-5457-4d8b-a2e1-c7b156b176e5" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_EasyNet {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/TheWover/EasyNet"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "3097d856-25c2-42c9-8d59-2cdad8e8ea12" ascii nocase wide
        $typelibguid1 = "ba33f716-91e0-4cf7-b9bd-b4d558f9a173" ascii nocase wide
        $typelibguid2 = "37d6dd3f-5457-4d8b-a2e1-c7b156b176e5" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpByeBear
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/S3cur3Th1sSh1t/SharpByeBear

Pattern signatures:
$typelibguid0 = "a6b84e35-2112-4df2-a31b-50fde4458c5e" ascii nocase wide
        $typelibguid1 = "3e82f538-6336-4fff-aeec-e774676205da" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpByeBear {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/S3cur3Th1sSh1t/SharpByeBear"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "a6b84e35-2112-4df2-a31b-50fde4458c5e" ascii nocase wide
        $typelibguid1 = "3e82f538-6336-4fff-aeec-e774676205da" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpHide
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/outflanknl/SharpHide

Pattern signatures:
$typelibguid0 = "443d8cbf-899c-4c22-b4f6-b7ac202d4e37" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpHide {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/outflanknl/SharpHide"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "443d8cbf-899c-4c22-b4f6-b7ac202d4e37" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpSvc
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/jnqpblc/SharpSvc

Pattern signatures:
$typelibguid0 = "52856b03-5acd-45e0-828e-13ccb16942d1" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpSvc {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/jnqpblc/SharpSvc"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "52856b03-5acd-45e0-828e-13ccb16942d1" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpCrashEventLog
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/slyd0g/SharpCrashEventLog

Pattern signatures:
$typelibguid0 = "98cb495f-4d47-4722-b08f-cefab2282b18" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpCrashEventLog {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/slyd0g/SharpCrashEventLog"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "98cb495f-4d47-4722-b08f-cefab2282b18" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_DotNetToJScript_LanguageModeBreakout
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout

Pattern signatures:
$typelibguid0 = "deadb33f-fa94-41b5-813d-e72d8677a0cf" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_DotNetToJScript_LanguageModeBreakout {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "deadb33f-fa94-41b5-813d-e72d8677a0cf" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharPermission
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/mitchmoser/SharPermission

Pattern signatures:
$typelibguid0 = "84d2b661-3267-49c8-9f51-8f72f21aea47" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharPermission {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/mitchmoser/SharPermission"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "84d2b661-3267-49c8-9f51-8f72f21aea47" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_RegistryStrikesBack
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/mdsecactivebreach/RegistryStrikesBack

Pattern signatures:
$typelibguid0 = "90ebd469-d780-4431-9bd8-014b00057665" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_RegistryStrikesBack {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/mdsecactivebreach/RegistryStrikesBack"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "90ebd469-d780-4431-9bd8-014b00057665" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_CloneVault
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/mdsecactivebreach/CloneVault

Pattern signatures:
$typelibguid0 = "0a344f52-6780-4d10-9a4a-cb9439f9d3de" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_CloneVault {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/mdsecactivebreach/CloneVault"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "0a344f52-6780-4d10-9a4a-cb9439f9d3de" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_donut
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/TheWover/donut

Pattern signatures:
$typelibguid0 = "98ca74c7-a074-434d-9772-75896e73ceaa" ascii nocase wide
        $typelibguid1 = "3c9a6b88-bed2-4ba8-964c-77ec29bf1846" ascii nocase wide
        $typelibguid2 = "4fcdf3a3-aeef-43ea-9297-0d3bde3bdad2" ascii nocase wide
        $typelibguid3 = "361c69f5-7885-4931-949a-b91eeab170e3" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_donut {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/TheWover/donut"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "98ca74c7-a074-434d-9772-75896e73ceaa" ascii nocase wide
        $typelibguid1 = "3c9a6b88-bed2-4ba8-964c-77ec29bf1846" ascii nocase wide
        $typelibguid2 = "4fcdf3a3-aeef-43ea-9297-0d3bde3bdad2" ascii nocase wide
        $typelibguid3 = "361c69f5-7885-4931-949a-b91eeab170e3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpHandler
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/jfmaes/SharpHandler

Pattern signatures:
$typelibguid0 = "46e39aed-0cff-47c6-8a63-6826f147d7bd" ascii nocase wide
        $typelibguid1 = "11dc83c6-8186-4887-b228-9dc4fd281a23" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpHandler {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/jfmaes/SharpHandler"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "46e39aed-0cff-47c6-8a63-6826f147d7bd" ascii nocase wide
        $typelibguid1 = "11dc83c6-8186-4887-b228-9dc4fd281a23" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Driver_Template
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/FuzzySecurity/Driver-Template

Pattern signatures:
$typelibguid0 = "bdb79ad6-639f-4dc2-8b8a-cd9107da3d69" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Driver_Template {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/FuzzySecurity/Driver-Template"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "bdb79ad6-639f-4dc2-8b8a-cd9107da3d69" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}