deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_NAME_SharpBuster
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/passthehashbrowns/SharpBuster

Pattern signatures:
$name = "SharpBuster" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_SharpBuster {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/passthehashbrowns/SharpBuster"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "d30c8ee5-88b9-53b5-b209-51f6f3b988cf"
    strings:
        $name = "SharpBuster" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_AmsiBypass
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/0xB455/AmsiBypass

Pattern signatures:
$s_name = "AmsiBypass" ascii wide
        $s_compile = "AssemblyTitle" ascii wide

        $fp1 = "Adaptive Threat Protection" wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of ($s*)
        and not 1 of ($fp*)

Full rule:
rule HKTL_NET_NAME_AmsiBypass {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/0xB455/AmsiBypass"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		hash = "8fa4ba512b34a898c4564a8eac254b6a786d195b"
        author = "Arnim Rupp"
        date = "2021-01-22"
        modified = "2024-12-10"
        id = "26db14d8-1034-5bd1-a719-4756c832901d"
    strings:
        $s_name = "AmsiBypass" ascii wide
        $s_compile = "AssemblyTitle" ascii wide

        $fp1 = "Adaptive Threat Protection" wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of ($s*)
        and not 1 of ($fp*)
}
YARA Detection Rule: HKTL_NET_NAME_Recon_AD
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/outflanknl/Recon-AD

Pattern signatures:
$name = "Recon-AD" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_Recon_AD {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/outflanknl/Recon-AD"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "097de5cd-0cd4-59cc-a7b7-54cad8e6d230"
    strings:
        $name = "Recon-AD" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_SharpWatchdogs
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/RITRedteam/SharpWatchdogs

Pattern signatures:
$name = "SharpWatchdogs" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_SharpWatchdogs {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/RITRedteam/SharpWatchdogs"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "5343be58-879a-5fe7-9036-ee6a22d85f22"
    strings:
        $name = "SharpWatchdogs" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_SharpCat
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/Cn33liz/SharpCat

Pattern signatures:
$name = "SharpCat" ascii wide fullword
        $compile = "AssemblyTitle" ascii wide fullword

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_SharpCat {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Cn33liz/SharpCat"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "a46be8d3-bf7b-5d86-b88b-33e6c8c152d8"
    strings:
        $name = "SharpCat" ascii wide fullword
        $compile = "AssemblyTitle" ascii wide fullword
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_K8tools
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/k8gege/K8tools

Pattern signatures:
$name = "K8tools" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_K8tools {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/k8gege/K8tools"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "b30fc856-073d-542f-b222-a957322732c2"
    strings:
        $name = "K8tools" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_HTTPSBeaconShell
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/limbenjamin/HTTPSBeaconShell

Pattern signatures:
$name = "HTTPSBeaconShell" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_HTTPSBeaconShell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "3bd7234b-a23e-5818-aed1-52d42023943b"
    strings:
        $name = "HTTPSBeaconShell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_Ghostpack_CompiledBinaries
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/r3motecontrol/Ghostpack-CompiledBinaries

Pattern signatures:
$name = "Ghostpack-CompiledBinaries" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_Ghostpack_CompiledBinaries {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "7cc81894-8c01-5a17-a7ed-1cb4cf1e2d53"
    strings:
        $name = "Ghostpack-CompiledBinaries" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_metasploit_sharp
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/VolatileMindsLLC/metasploit-sharp

Pattern signatures:
$name = "metasploit-sharp" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_metasploit_sharp {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/VolatileMindsLLC/metasploit-sharp"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "b425f241-4887-5368-b42b-3fbbd3b769c6"
    strings:
        $name = "metasploit-sharp" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_trevorc2
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/trustedsec/trevorc2

Pattern signatures:
$name = "trevorc2" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_trevorc2 {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/trustedsec/trevorc2"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "d1634a0d-6964-5886-b836-85c3ce6b8a17"
    strings:
        $name = "trevorc2" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_NativePayload_DNS2
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DamonMohammadbagher/NativePayload_DNS2

Pattern signatures:
$name = "NativePayload_DNS2" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_NativePayload_DNS2 {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/NativePayload_DNS2"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "0fa01355-de57-573e-9056-0b7a5d24572d"
    strings:
        $name = "NativePayload_DNS2" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_AggressiveProxy
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/EncodeGroup/AggressiveProxy

Pattern signatures:
$name = "AggressiveProxy" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_AggressiveProxy {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/EncodeGroup/AggressiveProxy"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "e2d3c4e2-404b-59f8-b3d0-a7cef4dfd0ff"
    strings:
        $name = "AggressiveProxy" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_MSBuildAPICaller
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/rvrsh3ll/MSBuildAPICaller

Pattern signatures:
$name = "MSBuildAPICaller" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_MSBuildAPICaller {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/rvrsh3ll/MSBuildAPICaller"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "143da57f-b01f-5688-b741-1bc4d06cd7d1"
    strings:
        $name = "MSBuildAPICaller" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_GrayKeylogger
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DarkSecDevelopers/GrayKeylogger

Pattern signatures:
$name = "GrayKeylogger" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_GrayKeylogger {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DarkSecDevelopers/GrayKeylogger"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "c63875b6-1701-5594-927e-833c25dc5d98"
    strings:
        $name = "GrayKeylogger" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_weevely3
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/epinna/weevely3

Pattern signatures:
$name = "weevely3" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_weevely3 {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/epinna/weevely3"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "6bf766b6-d065-5a84-8258-3be448b9cbb8"
    strings:
        $name = "weevely3" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_FudgeC2
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/Ziconius/FudgeC2

Pattern signatures:
$name = "FudgeC2" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_FudgeC2 {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Ziconius/FudgeC2"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "a8e70bce-76dd-53dc-9a19-1cc6795fdef3"
    strings:
        $name = "FudgeC2" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_NativePayload_Reverse_tcp
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp

Pattern signatures:
$name = "NativePayload_Reverse_tcp" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_NativePayload_Reverse_tcp {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "a6b935cc-adb6-5ff4-a832-1043e77292f7"
    strings:
        $name = "NativePayload_Reverse_tcp" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_SharpHose
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/ustayready/SharpHose

Pattern signatures:
$name = "SharpHose" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_SharpHose {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/ustayready/SharpHose"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "89b00eb0-f1a2-5c77-a5b0-2329b08aadb7"
    strings:
        $name = "SharpHose" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_RAT_NjRat_0_7d_modded_source_code
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code

Pattern signatures:
$name = "RAT-NjRat-0.7d-modded-source-code" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_RAT_NjRat_0_7d_modded_source_code {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "2b7d1f75-0164-561e-8199-32c601cbca98"
    strings:
        $name = "RAT-NjRat-0.7d-modded-source-code" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_RdpThief
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/0x09AL/RdpThief

Pattern signatures:
$name = "RdpThief" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_RdpThief {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/0x09AL/RdpThief"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "5ad4feec-50db-5ebb-a609-9196e72a24aa"
    strings:
        $name = "RdpThief" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_RunasCs
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/antonioCoco/RunasCs

Pattern signatures:
$name = "RunasCs" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_RunasCs {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/antonioCoco/RunasCs"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "c5fc5b01-1d30-5af5-be99-e629cb23295b"
    strings:
        $name = "RunasCs" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_NativePayload_IP6DNS
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DamonMohammadbagher/NativePayload_IP6DNS

Pattern signatures:
$name = "NativePayload_IP6DNS" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_NativePayload_IP6DNS {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/NativePayload_IP6DNS"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "3b32b408-e71a-5f2a-ae6f-72a3d6572b71"
    strings:
        $name = "NativePayload_IP6DNS" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_NativePayload_ARP
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DamonMohammadbagher/NativePayload_ARP

Pattern signatures:
$name = "NativePayload_ARP" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_NativePayload_ARP {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/NativePayload_ARP"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "9fac11f8-4e40-5cbc-a990-2ae48df20828"
    strings:
        $name = "NativePayload_ARP" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}