deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_GUID_DInvisibleRegistry
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/NVISO-BE/DInvisibleRegistry

Pattern signatures:
$typelibguid0lo = "31d576fb-9fb9-455e-ab02-c78981634c65" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_DInvisibleRegistry {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NVISO-BE/DInvisibleRegistry"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "98409bbe-6346-5825-b7f7-c1afeac2b038"
    strings:
        $typelibguid0lo = "31d576fb-9fb9-455e-ab02-c78981634c65" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_TikiTorch
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/rasta-mouse/TikiTorch

Pattern signatures:
$typelibguid0lo = "806c6c72-4adc-43d9-b028-6872fa48d334" ascii wide
        $typelibguid1lo = "2ef9d8f7-6b77-4b75-822b-6a53a922c30f" ascii wide
        $typelibguid2lo = "8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6" ascii wide
        $typelibguid3lo = "1f[PII_REDACTED]-4a34-a809-2c62b84d4f0a" ascii wide
        $typelibguid4lo = "97421325-b6d8-49e5-adf0-e2126abc17ee" ascii wide
        $typelibguid5lo = "06c247da-e2e1-47f3-bc3c-da0838a6df1f" ascii wide
        $typelibguid6lo = "fc700ac6-5182-421f-8853-0ad18cdbeb39" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_TikiTorch {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/TikiTorch"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "354ee690-a0d0-5cc5-a73b-53b916ed0169"
    strings:
        $typelibguid0lo = "806c6c72-4adc-43d9-b028-6872fa48d334" ascii wide
        $typelibguid1lo = "2ef9d8f7-6b77-4b75-822b-6a53a922c30f" ascii wide
        $typelibguid2lo = "8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6" ascii wide
        $typelibguid3lo = "1f[PII_REDACTED]-4a34-a809-2c62b84d4f0a" ascii wide
        $typelibguid4lo = "97421325-b6d8-49e5-adf0-e2126abc17ee" ascii wide
        $typelibguid5lo = "06c247da-e2e1-47f3-bc3c-da0838a6df1f" ascii wide
        $typelibguid6lo = "fc700ac6-5182-421f-8853-0ad18cdbeb39" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_HiveJack
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/Viralmaniar/HiveJack

Pattern signatures:
$typelibguid0lo = "e12e62fe-bea3-4989-bf04-6f76028623e3" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_HiveJack {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Viralmaniar/HiveJack"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "10567ef4-780f-5e93-9[PII_REDACTED]d6bbb"
    strings:
        $typelibguid0lo = "e12e62fe-bea3-4989-bf04-6f76028623e3" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_DecryptAutoLogon
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/securesean/DecryptAutoLogon

Pattern signatures:
$typelibguid0lo = "015a37fc-53d0-499b-bffe-ab88c5086040" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_DecryptAutoLogon {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/securesean/DecryptAutoLogon"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "3ef58da9-16c1-54cf-9d06-a05680548cf5"
    strings:
        $typelibguid0lo = "015a37fc-53d0-499b-bffe-ab88c5086040" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_UnstoppableService
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/malcomvetter/UnstoppableService

Pattern signatures:
$typelibguid0lo = "0c117ee5-2a21-dead-beef-8cc7f0caaa86" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_UnstoppableService {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/malcomvetter/UnstoppableService"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "8c65fbee-d779-57a8-851b-7583be66c67a"
    strings:
        $typelibguid0lo = "0c117ee5-2a21-dead-beef-8cc7f0caaa86" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpWMI_2
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/GhostPack/SharpWMI

Pattern signatures:
$typelibguid0lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpWMI_2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/SharpWMI"
        old_rule_name = "HKTL_NET_GUID_SharpWMI"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "e6ab2f5e-2a5a-5be9-9b66-96cb745fd199"
    strings:
        $typelibguid0lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_EWSToolkit
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/rasta-mouse/EWSToolkit

Pattern signatures:
$typelibguid0lo = "ca536d67-53c9-43b5-8bc8-9a05fdc567ed" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_EWSToolkit {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/EWSToolkit"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "acde7744-d17f-5e47-a5e2-ff4f4c4d8093"
    strings:
        $typelibguid0lo = "ca536d67-53c9-43b5-8bc8-9a05fdc567ed" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SweetPotato
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/CCob/SweetPotato

Pattern signatures:
$typelibguid0lo = "6aeb5004-6093-4c23-aeae-911d64cacc58" ascii wide
        $typelibguid1lo = "1bf9c10f-6f89-4520-9d2e-aaf17d17ba5e" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SweetPotato {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/CCob/SweetPotato"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "0e347d94-51eb-5589-93d8-b19fec7f2365"
    strings:
        $typelibguid0lo = "6aeb5004-6093-4c23-aeae-911d64cacc58" ascii wide
        $typelibguid1lo = "1bf9c10f-6f89-4520-9d2e-aaf17d17ba5e" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_memscan
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/nccgroup/memscan

Pattern signatures:
$typelibguid0lo = "79462f87-8418-4834-9356-8c11e44ce189" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_memscan {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/nccgroup/memscan"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "35175fe1-a583-50d1-8b0c-71f19b898817"
    strings:
        $typelibguid0lo = "79462f87-8418-4834-9356-8c11e44ce189" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpStay
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/0xthirteen/SharpStay

Pattern signatures:
$typelibguid0lo = "2963c954-7b1e-47f5-b4fa-2fc1f0d56aea" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpStay {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xthirteen/SharpStay"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "e5bde5a9-8e09-59ce-ad01-e29836813cf8"
    strings:
        $typelibguid0lo = "2963c954-7b1e-47f5-b4fa-2fc1f0d56aea" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpLocker
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/Pickfordmatt/SharpLocker

Pattern signatures:
$typelibguid0lo = "a6f8500f-68bc-4efc-962a-6c6e68d893af" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpLocker {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Pickfordmatt/SharpLocker"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "9525422a-d670-5475-abdc-b7ecd1ab9943"
    strings:
        $typelibguid0lo = "a6f8500f-68bc-4efc-962a-6c6e68d893af" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SauronEye
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/vivami/SauronEye

Pattern signatures:
$typelibguid0lo = "0f43043d-8957-4ade-a0f4-25c1122e8118" ascii wide
        $typelibguid1lo = "086bf0ca-f1e4-4e8f-9040-a8c37a49fa26" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SauronEye {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/vivami/SauronEye"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "3b624dde-a63e-58ac-a4db-af931f1d8553"
    strings:
        $typelibguid0lo = "0f43043d-8957-4ade-a0f4-25c1122e8118" ascii wide
        $typelibguid1lo = "086bf0ca-f1e4-4e8f-9040-a8c37a49fa26" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_sitrep
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/mdsecactivebreach/sitrep

Pattern signatures:
$typelibguid0lo = "12963497-988f-46c0-9212-28b4b2b1831b" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_sitrep {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/mdsecactivebreach/sitrep"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "5f2ac63e-4be1-520c-82b1-1957027a63e2"
    strings:
        $typelibguid0lo = "12963497-988f-46c0-9212-28b4b2b1831b" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpClipboard
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/slyd0g/SharpClipboard

Pattern signatures:
$typelibguid0lo = "[PII_REDACTED]-86aa-ae01d17690be" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpClipboard {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/slyd0g/SharpClipboard"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "fd1b7786-8853-5858-ab03-da350e44f738"
    strings:
        $typelibguid0lo = "[PII_REDACTED]-86aa-ae01d17690be" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpCookieMonster
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/m0rv4i/SharpCookieMonster

Pattern signatures:
$typelibguid0lo = "566c5556-1204-4db9-9dc8-a24091baaa8e" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpCookieMonster {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/m0rv4i/SharpCookieMonster"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "87be6949-f4f5-5a5a-b804-c627ed0f4355"
    strings:
        $typelibguid0lo = "566c5556-1204-4db9-9dc8-a24091baaa8e" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_p0wnedShell
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/Cn33liz/p0wnedShell

Pattern signatures:
$typelibguid0lo = "2e9b1462-f47c-48ca-9d85[PII_REDACTED]81" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_p0wnedShell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Cn33liz/p0wnedShell"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "390b94d1-dda9-5a85-80ae-c79a3f7b0b9d"
    strings:
        $typelibguid0lo = "2e9b1462-f47c-48ca-9d85[PII_REDACTED]81" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpMove
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/0xthirteen/SharpMove

Pattern signatures:
$typelibguid0lo = "8bf82bbe-909c-4777-a2fc-ea7c070ff43e" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpMove {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xthirteen/SharpMove"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "e52392f9-614c-596e-8efd-aa0a2fa44e60"
    strings:
        $typelibguid0lo = "8bf82bbe-909c-4777-a2fc-ea7c070ff43e" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_C_Sharp_R_A_T_Client
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/AdvancedHacker101/C-Sharp-R.A.T-Client

Pattern signatures:
$typelibguid0lo = "6d9e8852-e86c-4e36-9cb4-b3c3853ed6b8" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_C_Sharp_R_A_T_Client {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/AdvancedHacker101/C-Sharp-R.A.T-Client"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "f5df8257-d202-58e3-9c4a-1dfc9dd52f2a"
    strings:
        $typelibguid0lo = "6d9e8852-e86c-4e36-9cb4-b3c3853ed6b8" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpPrinter
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/rvrsh3ll/SharpPrinter

Pattern signatures:
$typelibguid0lo = "41b2d1e5-4c5d-444c-aa47-629955401ed9" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpPrinter {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rvrsh3ll/SharpPrinter"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "10270351-ad80-5330-971b-bc8f635f05f4"
    strings:
        $typelibguid0lo = "41b2d1e5-4c5d-444c-aa47-629955401ed9" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_EvilFOCA
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/ElevenPaths/EvilFOCA

Pattern signatures:
$typelibguid0lo = "f26bdb4a-5846-4bec-8f52-3c39d32df495" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_EvilFOCA {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/ElevenPaths/EvilFOCA"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "2b2f5f6f-4224-5013-9e85-0ac088826bea"
    strings:
        $typelibguid0lo = "f26bdb4a-5846-4bec-8f52-3c39d32df495" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_PoshC2_Misc
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/nettitude/PoshC2_Misc

Pattern signatures:
$typelibguid0lo = "85773eb7-b159-45fe-96cd-11bad51da6de" ascii wide
        $typelibguid1lo = "9d32ad59-4093-420d-b45c-5fff391e990d" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_PoshC2_Misc {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/nettitude/PoshC2_Misc"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "245803cb-63d8-5c75-b672-912091cf4a80"
    strings:
        $typelibguid0lo = "85773eb7-b159-45fe-96cd-11bad51da6de" ascii wide
        $typelibguid1lo = "9d32ad59-4093-420d-b45c-5fff391e990d" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}