deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_GUID_ExploitRemotingService
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/tyranid/ExploitRemotingService

Pattern signatures:
$typelibguid0lo = "fd17ae38-2fd3-405f-b85b-e9d14e8e8261" ascii wide
        $typelibguid1lo = "1850b9bb-4a23-4d74-96b8-58f274674566" ascii wide
        $typelibguid2lo = "297cbca1-efa3-4f2a-8d5f-e1faf02ba587" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_ExploitRemotingService {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/tyranid/ExploitRemotingService"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-21"
        modified = "2025-08-15"
        id = "2f0b9635-2b2e-5825-baeb-69d7ae3791b1"
    strings:
        $typelibguid0lo = "fd17ae38-2fd3-405f-b85b-e9d14e8e8261" ascii wide
        $typelibguid1lo = "1850b9bb-4a23-4d74-96b8-58f274674566" ascii wide
        $typelibguid2lo = "297cbca1-efa3-4f2a-8d5f-e1faf02ba587" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Xploit
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/shargon/Xploit

Pattern signatures:
$typelibguid0lo = "4545cfde-9ee5-4f1b-b966-d128af0b9a6e" ascii wide
        $typelibguid1lo = "33849d2b-3be8-41e8-a1e2-614c94c4533c" ascii wide
        $typelibguid2lo = "c2dc73cc-a959-4965-8499-a9e1720e594b" ascii wide
        $typelibguid3lo = "77059fa1-4b7d-4406-bc1a-cb261086f915" ascii wide
        $typelibguid4lo = "a4a04c4d-5490-4309-9c90-351e5e5fd6d1" ascii wide
        $typelibguid5lo = "ca64f918-3296-4b7d-9ce6-b[PII_REDACTED]5" ascii wide
        $typelibguid6lo = "10fe32a0-d791-47b2-8530-0b19d91434f7" ascii wide
        $typelibguid7lo = "679bba57-3063-4f17-b491-4f0a730d6b02" ascii wide
        $typelibguid8lo = "0981e164-5930-4ba0-983c-1cf679e5033f" ascii wide
        $typelibguid9lo = "2a844ca2-5d6c-45b5-963b-7dca1140e16f" ascii wide
        $typelibguid10lo = "7d75ca11-8745-4382-b3eb-c41416dbc48c" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Xploit {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/shargon/Xploit"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-21"
        modified = "2025-08-15"
        id = "11ba6c14-06b6-5d9f-ac69-08ae506877e7"
    strings:
        $typelibguid0lo = "4545cfde-9ee5-4f1b-b966-d128af0b9a6e" ascii wide
        $typelibguid1lo = "33849d2b-3be8-41e8-a1e2-614c94c4533c" ascii wide
        $typelibguid2lo = "c2dc73cc-a959-4965-8499-a9e1720e594b" ascii wide
        $typelibguid3lo = "77059fa1-4b7d-4406-bc1a-cb261086f915" ascii wide
        $typelibguid4lo = "a4a04c4d-5490-4309-9c90-351e5e5fd6d1" ascii wide
        $typelibguid5lo = "ca64f918-3296-4b7d-9ce6-b[PII_REDACTED]5" ascii wide
        $typelibguid6lo = "10fe32a0-d791-47b2-8530-0b19d91434f7" ascii wide
        $typelibguid7lo = "679bba57-3063-4f17-b491-4f0a730d6b02" ascii wide
        $typelibguid8lo = "0981e164-5930-4ba0-983c-1cf679e5033f" ascii wide
        $typelibguid9lo = "2a844ca2-5d6c-45b5-963b-7dca1140e16f" ascii wide
        $typelibguid10lo = "7d75ca11-8745-4382-b3eb-c41416dbc48c" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_PoC
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/thezdi/PoC

Pattern signatures:
$typelibguid0lo = "89f9d411-e273-41bb-8711-209fd251ca88" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_PoC {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/thezdi/PoC"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-21"
        modified = "2025-08-15"
        id = "5669bc1a-b32e-5ae7-bf94-8ed2a124c765"
    strings:
        $typelibguid0lo = "89f9d411-e273-41bb-8711-209fd251ca88" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpGPOAbuse
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/FSecureLABS/SharpGPOAbuse

Pattern signatures:
$typelibguid0lo = "4f495784-b443-4838-9fa6-9149293af785" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpGPOAbuse {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/FSecureLABS/SharpGPOAbuse"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-21"
        modified = "2025-08-15"
        id = "ea27044f-69be-5db7-8d77-28dafb18c7e5"
    strings:
        $typelibguid0lo = "4f495784-b443-4838-9fa6-9149293af785" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Watson
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/rasta-mouse/Watson

Pattern signatures:
$typelibguid0lo = "49ad5f38-9e37-4967-9e84-fe19c7434ed7" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Watson {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/Watson"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-21"
        modified = "2025-08-15"
        id = "6dc7bb08-0b34-50a0-8ae8-02d96d66a334"
    strings:
        $typelibguid0lo = "49ad5f38-9e37-4967-9e84-fe19c7434ed7" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_StandIn
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/FuzzySecurity/StandIn

Pattern signatures:
$typelibguid0lo = "01c142ba-7af1-48d6-b185-81147a2f7db7" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_StandIn {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/FuzzySecurity/StandIn"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-21"
        modified = "2025-08-15"
        id = "2af3c28a-ce5d-5dea-9abe-ff54b180049e"
    strings:
        $typelibguid0lo = "01c142ba-7af1-48d6-b185-81147a2f7db7" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_azure_password_harvesting
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/guardicore/azure_password_harvesting

Pattern signatures:
$typelibguid0lo = "7ad1ff2d-32ac-4c54-b615-9bb164160dac" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_azure_password_harvesting {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/guardicore/azure_password_harvesting"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-21"
        modified = "2025-08-15"
        id = "681cf9da-d664-5402-b7ac-eb2cfad85da9"
    strings:
        $typelibguid0lo = "7ad1ff2d-32ac-4c54-b615-9bb164160dac" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_PowerOPS
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/fdiskyou/PowerOPS

Pattern signatures:
$typelibguid0lo = "2a3c5921-7442-42c3-8cb9-24f21d0b2414" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_PowerOPS {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/fdiskyou/PowerOPS"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-21"
        modified = "2025-08-15"
        id = "3ef9f099-13c9-5b6f-[PII_REDACTED]"
    strings:
        $typelibguid0lo = "2a3c5921-7442-42c3-8cb9-24f21d0b2414" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Random_CSharpTools
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/xorrior/Random-CSharpTools

Pattern signatures:
$typelibguid0lo = "f7fc19da-67a3-437d-b3b0-2a257f77a00b" ascii wide
        $typelibguid1lo = "47e85bb6-9138-4374-8092-0aeb301fe64b" ascii wide
        $typelibguid2lo = "c7d854d8-4e3a-43a6-872f-e0710e5943f7" ascii wide
        $typelibguid3lo = "d6685430-8d8d-4e2e-b202-de14efa25211" ascii wide
        $typelibguid4lo = "1df925fc-9a89-4170-b763-1c735430b7d0" ascii wide
        $typelibguid5lo = "817cc61b-8471-4c1e-b5d6-c754fc550a03" ascii wide
        $typelibguid6lo = "60116613-c74e-41b9-b80e-35e02f25891e" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Random_CSharpTools {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/xorrior/Random-CSharpTools"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-21"
        modified = "2025-08-15"
        id = "ad8b5573-ad20-50cd-927b-a6401b10e653"
    strings:
        $typelibguid0lo = "f7fc19da-67a3-437d-b3b0-2a257f77a00b" ascii wide
        $typelibguid1lo = "47e85bb6-9138-4374-8092-0aeb301fe64b" ascii wide
        $typelibguid2lo = "c7d854d8-4e3a-43a6-872f-e0710e5943f7" ascii wide
        $typelibguid3lo = "d6685430-8d8d-4e2e-b202-de14efa25211" ascii wide
        $typelibguid4lo = "1df925fc-9a89-4170-b763-1c735430b7d0" ascii wide
        $typelibguid5lo = "817cc61b-8471-4c1e-b5d6-c754fc550a03" ascii wide
        $typelibguid6lo = "60116613-c74e-41b9-b80e-35e02f25891e" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_CVE_2020_0668
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/RedCursorSecurityConsulting/CVE-2020-0668

Pattern signatures:
$typelibguid0lo = "1b4c5ec1-2845-40fd-a173-62c450f12ea5" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_CVE_2020_0668 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/RedCursorSecurityConsulting/CVE-2020-0668"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "54c87578-f0f1-5108-a736-b6acd9624d29"
    strings:
        $typelibguid0lo = "1b4c5ec1-2845-40fd-a173-62c450f12ea5" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_WindowsRpcClients
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/tyranid/WindowsRpcClients

Pattern signatures:
$typelibguid0lo = "843d8862-42eb-49ee-94e6-bca798dd33ea" ascii wide
        $typelibguid1lo = "632e4c3b-3013-46fc-bc6e-22828bf629e3" ascii wide
        $typelibguid2lo = "a2091d2f-6f7e-4118-a203-4cea4bea6bfa" ascii wide
        $typelibguid3lo = "950ef8ce-ec92-4e02-b122-0d41d83065b8" ascii wide
        $typelibguid4lo = "d51301bc-31aa-4475-8944-882ecf80e10d" ascii wide
        $typelibguid5lo = "823ff111-4de2-4637-af01-4bdc3ca4cf15" ascii wide
        $typelibguid6lo = "5d28f15e-3bb8-4088-abe0-b517b31d4595" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_WindowsRpcClients {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/tyranid/WindowsRpcClients"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "70fd7431-8c32-52a4-be9f-2a19ef77f2cc"
    strings:
        $typelibguid0lo = "843d8862-42eb-49ee-94e6-bca798dd33ea" ascii wide
        $typelibguid1lo = "632e4c3b-3013-46fc-bc6e-22828bf629e3" ascii wide
        $typelibguid2lo = "a2091d2f-6f7e-4118-a203-4cea4bea6bfa" ascii wide
        $typelibguid3lo = "950ef8ce-ec92-4e02-b122-0d41d83065b8" ascii wide
        $typelibguid4lo = "d51301bc-31aa-4475-8944-882ecf80e10d" ascii wide
        $typelibguid5lo = "823ff111-4de2-4637-af01-4bdc3ca4cf15" ascii wide
        $typelibguid6lo = "5d28f15e-3bb8-4088-abe0-b517b31d4595" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpFruit
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/rvrsh3ll/SharpFruit

Pattern signatures:
$typelibguid0lo = "3da2f6de-75be-4c9d-8070-08da45e79761" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpFruit {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rvrsh3ll/SharpFruit"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "bf318530-b17d-5275-84b2-c284528bdae6"
    strings:
        $typelibguid0lo = "3da2f6de-75be-4c9d-8070-08da45e79761" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpWitness
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/rasta-mouse/SharpWitness

Pattern signatures:
$typelibguid0lo = "b9f6ec34-4ccc-4247-bcef-c1daab9b4469" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpWitness {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/SharpWitness"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "5e707da6-b2dd-511e-89ad-d19b93e8fca6"
    strings:
        $typelibguid0lo = "b9f6ec34-4ccc-4247-bcef-c1daab9b4469" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_RexCrypter
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/syrex1013/RexCrypter

Pattern signatures:
$typelibguid0lo = "10cd7c1c-e56d-4b1b-80dc-e4c496c5fec5" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_RexCrypter {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/syrex1013/RexCrypter"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "5ebbeab3-3e93-5544-8f74-3d1b47335d8b"
    strings:
        $typelibguid0lo = "10cd7c1c-e56d-4b1b-80dc-e4c496c5fec5" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharPersist
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/fireeye/SharPersist

Pattern signatures:
$typelibguid0lo = "9d1b853e-58f1-4ba5-aefc-5c221ca30e48" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharPersist {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/fireeye/SharPersist"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "0c181186-7bb4-502b-8937-60cfd88ce689"
    strings:
        $typelibguid0lo = "9d1b853e-58f1-4ba5-aefc-5c221ca30e48" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_CVE_2019_1253
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/padovah4ck/CVE-2019-1253

Pattern signatures:
$typelibguid0lo = "584964c1-f983-498d-8370-23e27fdd0399" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_CVE_2019_1253 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/padovah4ck/CVE-2019-1253"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "3e18b533-1b85-5eaf-bb3d-aa5b90fd2e28"
    strings:
        $typelibguid0lo = "584964c1-f983-498d-8370-23e27fdd0399" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_scout
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/jaredhaight/scout

Pattern signatures:
$typelibguid0lo = "d9c76e82-b848-47d4-8f22-99bf22a8ee11" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_scout {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jaredhaight/scout"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "cd24cca7-3bc0-5e7a-9817-dc3b26ec8358"
    strings:
        $typelibguid0lo = "d9c76e82-b848-47d4-8f22-99bf22a8ee11" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Grouper2
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/l0ss/Grouper2/

Pattern signatures:
$typelibguid0lo = "5decaea3-2610-4065-99dc-65b9b4ba6ccd" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Grouper2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/l0ss/Grouper2/"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "a9cd9a16-b2a5-5d15-af89-7a8d0f1835bb"
    strings:
        $typelibguid0lo = "5decaea3-2610-4065-99dc-65b9b4ba6ccd" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}