deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: VULN_PrinterDriver_PrivEsc_CVE_2021_3438_Jul21
Repository: Neo23x0/signature-base
Detects: Detects affected drivers with PE timestamps older than the date of the initial report
Author: Florian Roth (Nextron Systems)
Reference: https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/

Pattern signatures:
$s1 = "This String is from Device Driver@@@@@ !!!" ascii 
      $s2 = "\\DosDevices\\ssportc" wide fullword

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 400KB
      and all of ($s*)
      /* date of the initial report by SentinelOne */
      and[PII_REDACTED] >= pe.timestamp

Full rule:
rule VULN_PrinterDriver_PrivEsc_CVE_2021_3438_Jul21 {
   meta:
      description = "Detects affected drivers with PE timestamps older than the date of the initial report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/"
      date = "2021-07-20"
      score = 70
      hash1 = "7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4"
      id = "34cd648a-3e3f-5832-8abe-18507931eb3d"
   strings:
      $s1 = "This String is from Device Driver@@@@@ !!!" ascii 
      $s2 = "\\DosDevices\\ssportc" wide fullword
   condition:
      uint16(0) == 0x5a4d
      and filesize < 400KB
      and all of ($s*)
      /* date of the initial report by SentinelOne */
      and[PII_REDACTED] >= pe.timestamp
}
YARA Detection Rule: MAL_RANSOM_COVID19_Apr20_1
Repository: Neo23x0/signature-base
Detects: Detects ransomware distributed in COVID-19 theme
Author: Florian Roth (Nextron Systems)
Reference: https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/

Pattern signatures:
$s1 = "/savekey.php" wide

      $op1 = { 3f ff ff ff ff ff 0b b4 }
      $op2 = { 60 2e 2e 2e af 34 34 34 b8 34 34 34 b8 34 34 34 }
      $op3 = { 1f 07 1a 37 85 05 05 36 83 05 05 36 83 05 05 34 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 700KB and
      2 of them

Full rule:
rule MAL_RANSOM_COVID19_Apr20_1 {
   meta:
      description = "Detects ransomware distributed in COVID-19 theme"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/"
      date = "2020-04-15"
      hash1 = "2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326"
      id = "fc723d1f-e969-5af6-af57-70d00bf797f4"
   strings:
      $s1 = "/savekey.php" wide

      $op1 = { 3f ff ff ff ff ff 0b b4 }
      $op2 = { 60 2e 2e 2e af 34 34 34 b8 34 34 34 b8 34 34 34 }
      $op3 = { 1f 07 1a 37 85 05 05 36 83 05 05 36 83 05 05 34 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 700KB and
      2 of them
}
YARA Detection Rule: HKTL_RedSun_Privilege_Escalation_Apr26
Repository: Neo23x0/signature-base
Detects: Detects RedSun hacktool used for privilege escalation through Microsoft Defender.
Author: Jonathan Peters (cod3nym)
Reference: https://github.com/Nightmare-Eclipse/RedSun

Pattern signatures:
$x1 = "\\??\\pipe\\REDSUN" wide
      $x2 = "The red sun shall prevail.\n" ascii fullword
      $x3 = "\\RedSun.pdb" ascii

      $s1 = "\\System32\\TieringEngineService.exe" wide
      $s2 = "SERIOUSLYMSFT" wide
      $s3 = "*H+H$!ELIF-TSET-SURIVITNA-DRADNATS-RACIE$}7)CC7)^P(45XZP\\4[PA@%P!O5X" ascii

Detection condition:
uint16(0) == 0x5a4d
      and (
         1 of ($x*)
         or 2 of ($s*)
      )
      or 3 of them

Full rule:
rule HKTL_RedSun_Privilege_Escalation_Apr26 {
   meta:
      description = "Detects RedSun hacktool used for privilege escalation through Microsoft Defender."
      author = "Jonathan Peters (cod3nym)"
      date = "2026-04-16"
      reference = "https://github.com/Nightmare-Eclipse/RedSun"
      hash = "57a70c383feb9af60b64ab6768a1ca1b3f7394b8c5ffdbfafc8e988d63935120"
      score = 80
   strings:
      $x1 = "\\??\\pipe\\REDSUN" wide
      $x2 = "The red sun shall prevail.\n" ascii fullword
      $x3 = "\\RedSun.pdb" ascii

      $s1 = "\\System32\\TieringEngineService.exe" wide
      $s2 = "SERIOUSLYMSFT" wide
      $s3 = "*H+H$!ELIF-TSET-SURIVITNA-DRADNATS-RACIE$}7)CC7)^P(45XZP\\4[PA@%P!O5X" ascii
   condition:
      uint16(0) == 0x5a4d
      and (
         1 of ($x*)
         or 2 of ($s*)
      )
      or 3 of them
}
YARA Detection Rule: MAL_RTF_Embedded_OLE_PE
Repository: Neo23x0/signature-base
Detects: Detects a suspicious string often used in PE files in a hex encoded object stream
Author: Florian Roth (Nextron Systems)
Reference: https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/

Pattern signatures:
/* Hex encoded strings */
      /* This program cannot be run in DOS mode */
      $a1 = "[PII_REDACTED]70726f6772616d2063616e6e6f[PII_REDACTED]72756e20696e20444f53206d6f6465" ascii
      /* KERNEL32.dll */
      $a2 = "4b45524e454c33322e646c6c" ascii
      /* C:\fakepath\ */
      $a3 = "433a5c66616b[PII_REDACTED]5c" ascii
      /* DOS Magic Header */
      $m3 = "4d5a[PII_REDACTED][PII_REDACTED]ffff"
      $m2 = "4d5a[PII_REDACTED]0004000f00ffff"
      $m1 = "4d5a[PII_REDACTED][PII_REDACTED]ffff"

Detection condition:
uint32be(0) == 0x7B5C7274 /* RTF */
      and 1 of them

Full rule:
rule MAL_RTF_Embedded_OLE_PE {
   meta:
      description = "Detects a suspicious string often used in PE files in a hex encoded object stream"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/"
      date = "2018-01-22"
      modified = "2023-11-25"
      score = 65
      id = "20044f08-9574-5baf-b91e-47613e490d62"
   strings:
      /* Hex encoded strings */
      /* This program cannot be run in DOS mode */
      $a1 = "[PII_REDACTED]70726f6772616d2063616e6e6f[PII_REDACTED]72756e20696e20444f53206d6f6465" ascii
      /* KERNEL32.dll */
      $a2 = "4b45524e454c33322e646c6c" ascii
      /* C:\fakepath\ */
      $a3 = "433a5c66616b[PII_REDACTED]5c" ascii
      /* DOS Magic Header */
      $m3 = "4d5a[PII_REDACTED][PII_REDACTED]ffff"
      $m2 = "4d5a[PII_REDACTED]0004000f00ffff"
      $m1 = "4d5a[PII_REDACTED][PII_REDACTED]ffff"
   condition:
      uint32be(0) == 0x7B5C7274 /* RTF */
      and 1 of them
}
YARA Detection Rule: APT_MAL_HP_iLO_Firmware_Dec21_1
Repository: Neo23x0/signature-base
Detects: Detects suspicios ELF files with sections as described in malicious iLO Board analysis by AmnPardaz in December 2021
Author: Florian Roth (Nextron Systems)
Reference: https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/

Pattern signatures:
$s1 = ".newelf.elf.text" ascii
      $s2 = ".newelf.elf.libc.so.data" ascii
      $s3 = ".newelf.elf.Initial.stack" ascii
      $s4 = ".newelf.elf.libevlog.so.data" ascii

Detection condition:
filesize < 5MB and 2 of them or 
      all of them

Full rule:
rule APT_MAL_HP_iLO_Firmware_Dec21_1 {
   meta:
      description = "Detects suspicios ELF files with sections as described in malicious iLO Board analysis by AmnPardaz in December 2021"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/"
      date = "2021-12-28"
      score = 80
      id = "7f5fa905-07a3-55da-b644-c5ab882b4a9d"
   strings:
      $s1 = ".newelf.elf.text" ascii
      $s2 = ".newelf.elf.libc.so.data" ascii
      $s3 = ".newelf.elf.Initial.stack" ascii
      $s4 = ".newelf.elf.libevlog.so.data" ascii
   condition:
      filesize < 5MB and 2 of them or 
      all of them
}
YARA Detection Rule: HKTL_NET_NAME_FakeFileMaker
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DamonMohammadbagher/FakeFileMaker

Pattern signatures:
$name = "FakeFileMaker" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_FakeFileMaker {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/FakeFileMaker"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "2c87114f-5295-583f-b567-623d478ce0eb"
    strings:
        $name = "FakeFileMaker" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_WMIPersistence
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/mdsecactivebreach/WMIPersistence

Pattern signatures:
$name = "WMIPersistence" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_WMIPersistence {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/mdsecactivebreach/WMIPersistence"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "7a674596-c697-569d-a16c-3cefe4ff752a"
    strings:
        $name = "WMIPersistence" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_ADCollector
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/dev-2null/ADCollector

Pattern signatures:
$s_name = "ADCollector" ascii wide
        $s_compile = "AssemblyTitle" ascii wide

        $fp1 = "Symantec Threat Defense" wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of ($s*)
        and not 1 of ($fp*)

Full rule:
rule HKTL_NET_NAME_ADCollector {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/dev-2null/ADCollector"
        license = "https://creativecommons.org/licenses/by-nc/4.0/"
        hash = "5391239f479c26e699b6f3a1d6a0a8aa1a0cf9a8"
        hash = "9dd0f322dd57b906da1e543c44e764954704abae"
        author = "Arnim Rupp"
        date = "2021-01-22"
        modified = "2022-09-15"
    strings:
        $s_name = "ADCollector" ascii wide
        $s_compile = "AssemblyTitle" ascii wide

        $fp1 = "Symantec Threat Defense" wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of ($s*)
        and not 1 of ($fp*)
}
YARA Detection Rule: HKTL_NET_AdCollector_Sep22_1
Repository: Neo23x0/signature-base
Detects: Detects ADCollector Tool - a lightweight tool to quickly extract valuable information from the Active Directory environment for both attacking and defending
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/dev-2null/ADCollector

Pattern signatures:
$x1 = "ADCollector.exe --SPNs --Term key --Acls 'CN=Domain Admins,CN=Users,DC=lab,DC=local'" wide fullword
      $s1 = "ADCollector.exe" wide fullword
      $s2 = "ENCRYPTED_TEXT_PASSWORD_ALLOWED" ascii fullword
      $s3 = "\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf" wide
      $s4 = "[-] Password Does Not Expire Accounts:" wide
      $s5 = "  * runAs:       {0}" wide fullword

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 300KB and ( 1 of ($x*) or 3 of them )

Full rule:
rule HKTL_NET_AdCollector_Sep22_1 {
   meta:
      description = "Detects ADCollector Tool - a lightweight tool to quickly extract valuable information from the Active Directory environment for both attacking and defending"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/dev-2null/ADCollector"
      date = "2022-09-15"
      score = 75
      hash1 = "241390219a0a773463601ca68b77af97453c20af00a66492a7a78c04d481d338"
      hash2 = "cc086eb7316e68661e3d547b414890d5029c5cc460134d8b628f4b0be7f27fb3"
      id = "48b376e4-752b-523e-b34e-65b6944c33fb"
   strings:
      $x1 = "ADCollector.exe --SPNs --Term key --Acls 'CN=Domain Admins,CN=Users,DC=lab,DC=local'" wide fullword
      $s1 = "ADCollector.exe" wide fullword
      $s2 = "ENCRYPTED_TEXT_PASSWORD_ALLOWED" ascii fullword
      $s3 = "\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf" wide
      $s4 = "[-] Password Does Not Expire Accounts:" wide
      $s5 = "  * runAs:       {0}" wide fullword
   condition:
      uint16(0) == 0x5a4d and
      filesize < 300KB and ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: HKTL_NET_NAME_MaliciousClickOnceGenerator
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator

Pattern signatures:
$name = "MaliciousClickOnceGenerator" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_MaliciousClickOnceGenerator {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "683af3b4-4c91-5ff3-96bf-d5c1d9c19cc2"
    strings:
        $name = "MaliciousClickOnceGenerator" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_directInjectorPOC
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/badBounty/directInjectorPOC

Pattern signatures:
$name = "directInjectorPOC" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_directInjectorPOC {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/badBounty/directInjectorPOC"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "d9a430d7-b062-554b-aff4-cfd98d91e9fe"
    strings:
        $name = "directInjectorPOC" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_AsStrongAsFuck
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/Charterino/AsStrongAsFuck

Pattern signatures:
$name = "AsStrongAsFuck" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_AsStrongAsFuck {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Charterino/AsStrongAsFuck"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "4c63c8a2-5889-5177-9f66-8e5f755025a3"
    strings:
        $name = "AsStrongAsFuck" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_MagentoScanner
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/soufianetahiri/MagentoScanner

Pattern signatures:
$name = "MagentoScanner" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_MagentoScanner {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/soufianetahiri/MagentoScanner"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "db3912bd-574c-57e2-a9b6-4b440d144471"
    strings:
        $name = "MagentoScanner" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_RevengeRAT_Stub_CSsharp
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/NYAN-x-CAT/RevengeRAT-Stub-CSsharp

Pattern signatures:
$name = "RevengeRAT-Stub-CSsharp" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_RevengeRAT_Stub_CSsharp {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/NYAN-x-CAT/RevengeRAT-Stub-CSsharp"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "06dce4f9-4d7a-5976-a87a-07c539e5dbe8"
    strings:
        $name = "RevengeRAT-Stub-CSsharp" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_SharPyShell
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/antonioCoco/SharPyShell

Pattern signatures:
$name = "SharPyShell" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_SharPyShell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/antonioCoco/SharPyShell"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "3069c5eb-446e-5bfa-9df0-2e03f229d4d1"
    strings:
        $name = "SharPyShell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_GhostLoader
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/TheWover/GhostLoader

Pattern signatures:
$name = "GhostLoader" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_GhostLoader {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/TheWover/GhostLoader"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "d8d88f3f-f250-55ff-88a6-4623e12ef89d"
    strings:
        $name = "GhostLoader" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_DotNetInject
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/dtrizna/DotNetInject

Pattern signatures:
$name = "DotNetInject" ascii wide
        $compile = "AssemblyTitle" ascii wide

        $fp1 = "GetDotNetInjector" ascii /* MS Txt2AI 489044cadaa0175e36d286fcbe5720fd56b6a0c063beac452b2316c2714332b0 */
        $fp2 = "JetBrains.TeamCity.Injector." wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550)
        and filesize < 20MB
        and $name and $compile
        and not 1 of ($fp*)

Full rule:
rule HKTL_NET_NAME_DotNetInject {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/dtrizna/DotNetInject"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        modified = "2022-06-28"
        id = "468f89c4-5b94-53be-b9e6-ad21de7d98ba"
    strings:
        $name = "DotNetInject" ascii wide
        $compile = "AssemblyTitle" ascii wide

        $fp1 = "GetDotNetInjector" ascii /* MS Txt2AI 489044cadaa0175e36d286fcbe5720fd56b6a0c063beac452b2316c2714332b0 */
        $fp2 = "JetBrains.TeamCity.Injector." wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550)
        and filesize < 20MB
        and $name and $compile
        and not 1 of ($fp*)
}
YARA Detection Rule: HKTL_NET_NAME_ATPMiniDump
Repository: Neo23x0/signature-base
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/b4rtik/ATPMiniDump

Pattern signatures:
$name = "ATPMiniDump" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_ATPMiniDump {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/b4rtik/ATPMiniDump"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2021-01-22"
        id = "97981569-fe94-5600-8319-946edb4265e7"
    strings:
        $name = "ATPMiniDump" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: SUSP_NET_NAME_ConfuserEx
Repository: Neo23x0/signature-base
Detects: Detects ConfuserEx packed file
Author: Arnim Rupp
Reference: https://github.com/yck1509/ConfuserEx

Pattern signatures:
$name = "ConfuserEx" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule SUSP_NET_NAME_ConfuserEx {
    meta:
        description = "Detects ConfuserEx packed file"
        reference = "https://github.com/yck1509/ConfuserEx"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        score = 40
        date = "2021-01-22"
        modified = "2021-01-25"
        id = "f1bda14e-c9fe-5341-8962-691a66233eb0"
    strings:
        $name = "ConfuserEx" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}