deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_GUID_SharpExec
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/anthemtotheego/SharpExec

Pattern signatures:
$typelibguid0 = "7fbad126-e21c-4c4e-a9f0-613fcf585a71" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpExec {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/anthemtotheego/SharpExec"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "7fbad126-e21c-4c4e-a9f0-613fcf585a71" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpCOM
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/rvrsh3ll/SharpCOM

Pattern signatures:
$typelibguid0 = "51960f7d-76fe-499f-afbd-acabd7ba50d1" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpCOM {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rvrsh3ll/SharpCOM"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "51960f7d-76fe-499f-afbd-acabd7ba50d1" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Inception
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/two06/Inception

Pattern signatures:
$typelibguid0 = "03d96b8c-efd1-44a9-8db2-0b74db5d247a" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Inception {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/two06/Inception"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "03d96b8c-efd1-44a9-8db2-0b74db5d247a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_sharpwmi
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/QAX-A-Team/sharpwmi

Pattern signatures:
$typelibguid0 = "bb357d38-6dc1-4f20-a54c-d664bd20677e" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_sharpwmi {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/QAX-A-Team/sharpwmi"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "bb357d38-6dc1-4f20-a54c-d664bd20677e" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_CVE_2019_1064
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/RythmStick/CVE-2019-1064

Pattern signatures:
$typelibguid0 = "ff97e98a-635e-4ea9-b2d0-1a13f6bdbc38" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_CVE_2019_1064 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/RythmStick/CVE-2019-1064"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "ff97e98a-635e-4ea9-b2d0-1a13f6bdbc38" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Tokenvator
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/0xbadjuju/Tokenvator

Pattern signatures:
$typelibguid0 = "4b2b3bd4-d28f-44cc-96b3-4a2f64213109" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Tokenvator {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xbadjuju/Tokenvator"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "4b2b3bd4-d28f-44cc-96b3-4a2f64213109" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_WheresMyImplant
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/0xbadjuju/WheresMyImplant

Pattern signatures:
$typelibguid0 = "cca59e4e-ce4d-40fc-965f-34560330c7e6" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_WheresMyImplant {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xbadjuju/WheresMyImplant"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "cca59e4e-ce4d-40fc-965f-34560330c7e6" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Naga
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/byt3bl33d3r/Naga

Pattern signatures:
$typelibguid0 = "99[PII_REDACTED]-47b6-a323-0bb7d6d07c95" ascii nocase wide
        $typelibguid1 = "a2c9488f-6067-4b17-8c6f-2d464e65c535" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Naga {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/byt3bl33d3r/Naga"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "99[PII_REDACTED]-47b6-a323-0bb7d6d07c95" ascii nocase wide
        $typelibguid1 = "a2c9488f-6067-4b17-8c6f-2d464e65c535" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpBox
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/P1CKLES/SharpBox

Pattern signatures:
$typelibguid0 = "616c1afb-2944-42ed-9951-bf435cadb600" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpBox {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/P1CKLES/SharpBox"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "616c1afb-2944-42ed-9951-bf435cadb600" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_rundotnetdll32
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/0xbadjuju/rundotnetdll32

Pattern signatures:
$typelibguid0 = "a766db28-94b6-4ed1-aef9-5200bbdd8ca7" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_rundotnetdll32 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xbadjuju/rundotnetdll32"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "a766db28-94b6-4ed1-aef9-5200bbdd8ca7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_AntiDebug
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/malcomvetter/AntiDebug

Pattern signatures:
$typelibguid0 = "997265c1-1342-4d44-aded-67964a32f859" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_AntiDebug {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/malcomvetter/AntiDebug"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "997265c1-1342-4d44-aded-67964a32f859" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_DInvisibleRegistry
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/NVISO-BE/DInvisibleRegistry

Pattern signatures:
$typelibguid0 = "31d576fb-9fb9-455e-ab02-c78981634c65" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_DInvisibleRegistry {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NVISO-BE/DInvisibleRegistry"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "31d576fb-9fb9-455e-ab02-c78981634c65" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_TikiTorch
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/rasta-mouse/TikiTorch

Pattern signatures:
$typelibguid0 = "806c6c72-4adc-43d9-b028-6872fa48d334" ascii nocase wide
        $typelibguid1 = "2ef9d8f7-6b77-4b75-822b-6a53a922c30f" ascii nocase wide
        $typelibguid2 = "8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6" ascii nocase wide
        $typelibguid3 = "1f[PII_REDACTED]-4a34-a809-2c62b84d4f0a" ascii nocase wide
        $typelibguid4 = "97421325-b6d8-49e5-adf0-e2126abc17ee" ascii nocase wide
        $typelibguid5 = "06c247da-e2e1-47f3-bc3c-da0838a6df1f" ascii nocase wide
        $typelibguid6 = "fc700ac6-5182-421f-8853-0ad18cdbeb39" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_TikiTorch {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/TikiTorch"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "806c6c72-4adc-43d9-b028-6872fa48d334" ascii nocase wide
        $typelibguid1 = "2ef9d8f7-6b77-4b75-822b-6a53a922c30f" ascii nocase wide
        $typelibguid2 = "8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6" ascii nocase wide
        $typelibguid3 = "1f[PII_REDACTED]-4a34-a809-2c62b84d4f0a" ascii nocase wide
        $typelibguid4 = "97421325-b6d8-49e5-adf0-e2126abc17ee" ascii nocase wide
        $typelibguid5 = "06c247da-e2e1-47f3-bc3c-da0838a6df1f" ascii nocase wide
        $typelibguid6 = "fc700ac6-5182-421f-8853-0ad18cdbeb39" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_HiveJack
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/Viralmaniar/HiveJack

Pattern signatures:
$typelibguid0 = "e12e62fe-bea3-4989-bf04-6f76028623e3" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_HiveJack {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Viralmaniar/HiveJack"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "e12e62fe-bea3-4989-bf04-6f76028623e3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_DecryptAutoLogon
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/securesean/DecryptAutoLogon

Pattern signatures:
$typelibguid0 = "015a37fc-53d0-499b-bffe-ab88c5086040" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_DecryptAutoLogon {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/securesean/DecryptAutoLogon"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "015a37fc-53d0-499b-bffe-ab88c5086040" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_UnstoppableService
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/malcomvetter/UnstoppableService

Pattern signatures:
$typelibguid0 = "0c117ee5-2a21-dead-beef-8cc7f0caaa86" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_UnstoppableService {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/malcomvetter/UnstoppableService"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "0c117ee5-2a21-dead-beef-8cc7f0caaa86" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpWMI
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/GhostPack/SharpWMI

Pattern signatures:
$typelibguid0 = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpWMI {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/SharpWMI"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_EWSToolkit
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/rasta-mouse/EWSToolkit

Pattern signatures:
$typelibguid0 = "ca536d67-53c9-43b5-8bc8-9a05fdc567ed" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_EWSToolkit {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/EWSToolkit"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "ca536d67-53c9-43b5-8bc8-9a05fdc567ed" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SweetPotato
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/CCob/SweetPotato

Pattern signatures:
$typelibguid0 = "6aeb5004-6093-4c23-aeae-911d64cacc58" ascii nocase wide
        $typelibguid1 = "1bf9c10f-6f89-4520-9d2e-aaf17d17ba5e" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SweetPotato {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/CCob/SweetPotato"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "6aeb5004-6093-4c23-aeae-911d64cacc58" ascii nocase wide
        $typelibguid1 = "1bf9c10f-6f89-4520-9d2e-aaf17d17ba5e" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_memscan
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/nccgroup/memscan

Pattern signatures:
$typelibguid0 = "79462f87-8418-4834-9356-8c11e44ce189" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_memscan {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/nccgroup/memscan"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "79462f87-8418-4834-9356-8c11e44ce189" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpStay
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/0xthirteen/SharpStay

Pattern signatures:
$typelibguid0 = "2963c954-7b1e-47f5-b4fa-2fc1f0d56aea" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpStay {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xthirteen/SharpStay"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "2963c954-7b1e-47f5-b4fa-2fc1f0d56aea" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpLocker
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/Pickfordmatt/SharpLocker

Pattern signatures:
$typelibguid0 = "a6f8500f-68bc-4efc-962a-6c6e68d893af" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpLocker {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Pickfordmatt/SharpLocker"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "a6f8500f-68bc-4efc-962a-6c6e68d893af" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SauronEye
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/vivami/SauronEye

Pattern signatures:
$typelibguid0 = "0f43043d-8957-4ade-a0f4-25c1122e8118" ascii nocase wide
        $typelibguid1 = "086bf0ca-f1e4-4e8f-9040-a8c37a49fa26" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SauronEye {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/vivami/SauronEye"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "0f43043d-8957-4ade-a0f4-25c1122e8118" ascii nocase wide
        $typelibguid1 = "086bf0ca-f1e4-4e8f-9040-a8c37a49fa26" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_sitrep
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/mdsecactivebreach/sitrep

Pattern signatures:
$typelibguid0 = "12963497-988f-46c0-9212-28b4b2b1831b" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_sitrep {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/mdsecactivebreach/sitrep"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "12963497-988f-46c0-9212-28b4b2b1831b" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpClipboard
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/slyd0g/SharpClipboard

Pattern signatures:
$typelibguid0 = "[PII_REDACTED]-86aa-ae01d17690be" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpClipboard {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/slyd0g/SharpClipboard"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "[PII_REDACTED]-86aa-ae01d17690be" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpCookieMonster
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/m0rv4i/SharpCookieMonster

Pattern signatures:
$typelibguid0 = "566c5556-1204-4db9-9dc8-a24091baaa8e" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpCookieMonster {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/m0rv4i/SharpCookieMonster"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "566c5556-1204-4db9-9dc8-a24091baaa8e" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_p0wnedShell
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/Cn33liz/p0wnedShell

Pattern signatures:
$typelibguid0 = "2e9b1462-f47c-48ca-9d85[PII_REDACTED]81" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_p0wnedShell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Cn33liz/p0wnedShell"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "2e9b1462-f47c-48ca-9d85[PII_REDACTED]81" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}