deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_GUID_ForgeCert
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/GhostPack/ForgeCert

Pattern signatures:
$typelibguid0lo = "bd346689-8ee6-40b3-858b-4ed94f08d40a" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_ForgeCert {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/ForgeCert"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-18"
        modified = "2025-08-15"
        id = "06b3ffbb-5a76-50a0-86dc-b9658bf2d7ec"
    strings:
        $typelibguid0lo = "bd346689-8ee6-40b3-858b-4ed94f08d40a" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Crassus
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/vu-ls/Crassus

Pattern signatures:
$typelibguid0lo = "7e9729aa-4cf2-4d0a-8183-7fb7ce7a5b1a" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Crassus {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/vu-ls/Crassus"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-18"
        modified = "2025-08-15"
        id = "d4f94aa3-0431-5ac1-8718-0f0526c3714f"
    strings:
        $typelibguid0lo = "7e9729aa-4cf2-4d0a-8183-7fb7ce7a5b1a" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_RestrictedAdmin
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/GhostPack/RestrictedAdmin

Pattern signatures:
$typelibguid0lo = "79f11fc0-abff-4e1f-b07c-5d65653d8952" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_RestrictedAdmin {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/RestrictedAdmin"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-18"
        modified = "2025-08-15"
        id = "1b3572a5-bb21-58bb-91f9-963a0a17d699"
    strings:
        $typelibguid0lo = "79f11fc0-abff-4e1f-b07c-5d65653d8952" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_p2p
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid (p2p Remote Desktop is dual use but 100% flagged as malicious on VT)
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/miroslavpejic85/p2p

Pattern signatures:
$typelibguid0lo = "33456e72-f8e8-4384-88c4-700867df12e2" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_p2p {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid (p2p Remote Desktop is dual use but 100% flagged as malicious on VT)"
        reference = "https://github.com/miroslavpejic85/p2p"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-19"
        modified = "2025-08-15"
        id = "e7b2b4bd-f1e1-5062-9b36-5df44ae374ea"
    strings:
        $typelibguid0lo = "33456e72-f8e8-4384-88c4-700867df12e2" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpWSUS
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/nettitude/SharpWSUS

Pattern signatures:
$typelibguid0lo = "42cabb74-1199-40f1-9354-6294bba8d3a4" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpWSUS {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/nettitude/SharpWSUS"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "f020eea9-4ff4-5242-b9b2-53284505dab4"
    strings:
        $typelibguid0lo = "42cabb74-1199-40f1-9354-6294bba8d3a4" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpImpersonation
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/S3cur3Th1sSh1t/SharpImpersonation

Pattern signatures:
$typelibguid0lo = "27a85262-8c87-4147-a908-46728ab7fc73" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpImpersonation {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/S3cur3Th1sSh1t/SharpImpersonation"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "5815c5bd-e3e8-5f2f-b03e-8a05fb4f6e91"
    strings:
        $typelibguid0lo = "27a85262-8c87-4147-a908-46728ab7fc73" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpCloud
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/chrismaddalena/SharpCloud

Pattern signatures:
$typelibguid0lo = "ca4e257e-69c1-45c5-9375-ba[PII_REDACTED]" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpCloud {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/chrismaddalena/SharpCloud"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "048b0239-ea13-58ff-af35-fd505b4c977a"
    strings:
        $typelibguid0lo = "ca4e257e-69c1-45c5-9375-ba[PII_REDACTED]" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpSSDP
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/rvrsh3ll/SharpSSDP

Pattern signatures:
$typelibguid0lo = "6e383de4-de89-4247-a41a-79db1dc03aaa" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpSSDP {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/rvrsh3ll/SharpSSDP"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "8441e940-ab7c-5467-9db8-35f71bd57580"
    strings:
        $typelibguid0lo = "6e383de4-de89-4247-a41a-79db1dc03aaa" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_WireTap
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/djhohnstein/WireTap

Pattern signatures:
$typelibguid0lo = "b5067468-f656-450a-b29c-1c84cfe8dde5" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_WireTap {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/djhohnstein/WireTap"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "5513a295-8907-5a9c-adca-760b33004229"
    strings:
        $typelibguid0lo = "b5067468-f656-450a-b29c-1c84cfe8dde5" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_KittyLitter
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/djhohnstein/KittyLitter

Pattern signatures:
$typelibguid0lo = "449cf269-4798-4268-9a0d-9a17a08869ba" ascii wide
        $typelibguid1lo = "e7a509a4-2d44-4e10-95bf-b86cb7767c2c" ascii wide
        $typelibguid2lo = "b2b8dd4f-eba6-42a1-a53d-9a00fe785d66" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_KittyLitter {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/djhohnstein/KittyLitter"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "f457b91f-4adb-5be6-b9c2-f6cc39d4bdaf"
    strings:
        $typelibguid0lo = "449cf269-4798-4268-9a0d-9a17a08869ba" ascii wide
        $typelibguid1lo = "e7a509a4-2d44-4e10-95bf-b86cb7767c2c" ascii wide
        $typelibguid2lo = "b2b8dd4f-eba6-42a1-a53d-9a00fe785d66" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpView
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/tevora-threat/SharpView

Pattern signatures:
$typelibguid0lo = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpView {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/tevora-threat/SharpView"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "2ae1bc26-c137-55ce-ae2e-3204ff07f671"
    strings:
        $typelibguid0lo = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Farmer
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/mdsecactivebreach/Farmer

Pattern signatures:
$typelibguid0lo = "37da2573-d9b5-4fc2-ae11-ccb6130cea9f" ascii wide
        $typelibguid1lo = "49acf861-1c10-49a1-bf26-139a3b3a9227" ascii wide
        $typelibguid2lo = "9a6c028f-423f-4c2c-8db3-b3499139b822" ascii wide
        $typelibguid3lo = "1c896837-e729-46a9-92b9-3bbe7ac2c90d" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Farmer {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/mdsecactivebreach/Farmer"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "f69745b9-4ebd-547a-9af3-bc340b076e5d"
    strings:
        $typelibguid0lo = "37da2573-d9b5-4fc2-ae11-ccb6130cea9f" ascii wide
        $typelibguid1lo = "49acf861-1c10-49a1-bf26-139a3b3a9227" ascii wide
        $typelibguid2lo = "9a6c028f-423f-4c2c-8db3-b3499139b822" ascii wide
        $typelibguid3lo = "1c896837-e729-46a9-92b9-3bbe7ac2c90d" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_AESShellCodeInjector
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/san3ncrypt3d/AESShellCodeInjector

Pattern signatures:
$typelibguid0lo = "b016da9e-12a1-4f1d-91a1-d681ae54e92c" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_AESShellCodeInjector {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/san3ncrypt3d/AESShellCodeInjector"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "6253e30b-7c92-5237-a706-e93403a7c0b6"
    strings:
        $typelibguid0lo = "b016da9e-12a1-4f1d-91a1-d681ae54e92c" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpChromium
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/djhohnstein/SharpChromium

Pattern signatures:
$typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpChromium {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/djhohnstein/SharpChromium"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "5364956a-e199-556a-8055-0e7b9a7b14c8"
    strings:
        $typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Get_RBCD_Threaded
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/FatRodzianko/Get-RBCD-Threaded

Pattern signatures:
$typelibguid0lo = "e20dc2ed-6455-4101-9d78-fccac1cb7a18" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Get_RBCD_Threaded {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/FatRodzianko/Get-RBCD-Threaded"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "fdef6dc3-da1a-5a98-a822-94e443981fdd"
    strings:
        $typelibguid0lo = "e20dc2ed-6455-4101-9d78-fccac1cb7a18" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Whisker
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/eladshamir/Whisker

Pattern signatures:
$typelibguid0lo = "42750ac0-1bff-4f25-8c9d-9af144403bad" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Whisker {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/eladshamir/Whisker"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "ecb0c59f-2111-58d9-8dc9-dfe005cad3be"
    strings:
        $typelibguid0lo = "42750ac0-1bff-4f25-8c9d-9af144403bad" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_ShadowSpray
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/Dec0ne/ShadowSpray

Pattern signatures:
$typelibguid0lo = "7e47d586-ddc6-4382-848c-5cf0798084e1" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_ShadowSpray {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/Dec0ne/ShadowSpray"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "91dd52ef-07a1-5ffd-b5c3-59bca18d4c7c"
    strings:
        $typelibguid0lo = "7e47d586-ddc6-4382-848c-5cf0798084e1" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_MalSCCM
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/nettitude/MalSCCM

Pattern signatures:
$typelibguid0lo = "5439cecd-3bb3-4807-b33f-e4c299b71ca2" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_MalSCCM {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/nettitude/MalSCCM"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "4a88532b-e2bc-5ce9-828d-6ef62d91f6b9"
    strings:
        $typelibguid0lo = "5439cecd-3bb3-4807-b33f-e4c299b71ca2" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SpoolSample
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/leechristensen/SpoolSample

Pattern signatures:
$typelibguid0lo = "640c36b4-f417-4d85-b031-83a9d23c140b" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SpoolSample {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/leechristensen/SpoolSample"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "38346575-cf5b-59bf-b2b2-21aacf05b8a4"
    strings:
        $typelibguid0lo = "640c36b4-f417-4d85-b031-83a9d23c140b" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpOxidResolver
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/S3cur3Th1sSh1t/SharpOxidResolver

Pattern signatures:
$typelibguid0lo = "ce59f8ff-0ecf-41e9-a1fd-1776ca0b703d" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpOxidResolver {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/S3cur3Th1sSh1t/SharpOxidResolver"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-22"
        modified = "2025-08-15"
        id = "e8a957bc-3319-51c2-8289-01bd0b8a632a"
    strings:
        $typelibguid0lo = "ce59f8ff-0ecf-41e9-a1fd-1776ca0b703d" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Sharpcat
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/theart42/Sharpcat

Pattern signatures:
$typelibguid0 = "d16fd95f-23ce-4f8d-8763-b9f5a9cdd0c3" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Sharpcat {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/theart42/Sharpcat"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-11-30"
        id = "450d13c6-93ae-5bf5-bdde-d874ab6c0cd5"
    strings:
        $typelibguid0 = "d16fd95f-23ce-4f8d-8763-b9f5a9cdd0c3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}