deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_GUID_KeeThief
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/GhostPack/KeeThief

Pattern signatures:
$typelibguid1 = "39aa6f93-a1c9-497f-bad2-cc42a61d5710" ascii nocase wide
        $typelibguid3 = "3fca8012-3bad-41e4-91f4-534aa9a44f96" ascii nocase wide
        $typelibguid4 = "ea92f1e6-3f34-48f8-8b0a-f2bbc19220ef" ascii nocase wide
        $typelibguid5 = "c23b51c4-2475-4fc6-9b3a-27d0a2b99b0f" ascii nocase wide
        $typelibguid6 = "94432a8e-3e06-4776-b9b2-3684a62bb96a" ascii nocase wide
        $typelibguid7 = "80ba63a4-7d41-40e9-a722-6dd58b28bf7e" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_KeeThief {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/KeeThief"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid1 = "39aa6f93-a1c9-497f-bad2-cc42a61d5710" ascii nocase wide
        $typelibguid3 = "3fca8012-3bad-41e4-91f4-534aa9a44f96" ascii nocase wide
        $typelibguid4 = "ea92f1e6-3f34-48f8-8b0a-f2bbc19220ef" ascii nocase wide
        $typelibguid5 = "c23b51c4-2475-4fc6-9b3a-27d0a2b99b0f" ascii nocase wide
        $typelibguid6 = "94432a8e-3e06-4776-b9b2-3684a62bb96a" ascii nocase wide
        $typelibguid7 = "80ba63a4-7d41-40e9-a722-6dd58b28bf7e" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_fakelogonscreen
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/bitsadmin/fakelogonscreen

Pattern signatures:
$typelibguid0 = "d35a55bd-3189-498b-b72f-dc798172e505" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_fakelogonscreen {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/bitsadmin/fakelogonscreen"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "d35a55bd-3189-498b-b72f-dc798172e505" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_PoshSecFramework
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/PoshSec/PoshSecFramework

Pattern signatures:
$typelibguid0 = "b1ac6aa0-2f1a-4696-bf4b-0e41cf2f4b6b" ascii nocase wide
        $typelibguid1 = "78bfcfc2-ef1c-4514-bce6-934b251666d2" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_PoshSecFramework {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/PoshSec/PoshSecFramework"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "b1ac6aa0-2f1a-4696-bf4b-0e41cf2f4b6b" ascii nocase wide
        $typelibguid1 = "78bfcfc2-ef1c-4514-bce6-934b251666d2" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpAttack
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/jaredhaight/SharpAttack

Pattern signatures:
$typelibguid0 = "5f0ceca3-5997-406c-adf5-6c7fbb6cba17" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpAttack {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jaredhaight/SharpAttack"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "5f0ceca3-5997-406c-adf5-6c7fbb6cba17" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Altman
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/keepwn/Altman

Pattern signatures:
$typelibguid0 = "64cdcd2b-7356-4079-af78-e22210e66154" ascii nocase wide
        $typelibguid1 = "f1dee29d-ca98-46ea-9d13-93ae1fda96e1" ascii nocase wide
        $typelibguid2 = "33568320-56e8-4abb-83f8-548e8d6adac2" ascii nocase wide
        $typelibguid3 = "470ec930-70a3-4d71-b4ff-860fcb900e85" ascii nocase wide
        $typelibguid4 = "9514574d-6819-44f2-affa-6158ac1143b3" ascii nocase wide
        $typelibguid5 = "0f3a9c4f-0b11-4373-a0a6-3a6de814e891" ascii nocase wide
        $typelibguid6 = "9624b72e-9702-4d78-995b[PII_REDACTED]51" ascii nocase wide
        $typelibguid7 = "faae59a8-55fc-48b1-a9b5-b1759c9c1010" ascii nocase wide
        $typelibguid8 = "37af4988-f6f2-4f0c-aa2b-5b24f7ed3bf3" ascii nocase wide
        $typelibguid9 = "c82aa2fe-3332-441f-965e-6b653e088abf" ascii nocase wide
        $typelibguid10 = "6e531f6c-2c89-447f-8464-aaa96dbcdfff" ascii nocase wide
        $typelibguid11 = "231987a1-ea32-4087-8[PII_REDACTED]f16f6" ascii nocase wide
        $typelibguid12 = "7da0d93a

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Altman {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/keepwn/Altman"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "64cdcd2b-7356-4079-af78-e22210e66154" ascii nocase wide
        $typelibguid1 = "f1dee29d-ca98-46ea-9d13-93ae1fda96e1" ascii nocase wide
        $typelibguid2 = "33568320-56e8-4abb-83f8-548e8d6adac2" ascii nocase wide
        $typelibguid3 = "470ec930-70a3-4d71-b4ff-860fcb900e85" ascii nocase wide
        $typelibguid4 = "9514574d-6819-44f2-affa-6158ac1143b3" ascii nocase wide
        $typelibguid5 = "0f3a9c4f-0b11-4373-a0a6-3a6de814e891" ascii nocase wide
        $typelibguid6 = "9624b72e-9702-4d78-995b[PII_REDACTED]51" ascii nocase wide
        $typelibguid7 = "faae59a8-55fc-48b1-a9b5-b1759c9c1010" ascii nocase wide
        $typelibguid8 = "37af4988-f6f2-4f0c-aa2b-5b24f7ed3bf3" ascii nocase wide
        $typelibguid9 = "c82aa2fe-3332-441f-965e-6b653e088abf" ascii nocase wide
        $typelibguid10 = "6e531f6c-2c89-447f-8464-aaa96dbcdfff" ascii nocase wide
        $typelibguid11 = "231987a1-ea32-4087-8[PII_REDACTED]f16f6" ascii nocase wide
        $typelibguid12 = "7da0d93a-a0ae-41a5-9389-42eff85bb064" ascii nocase wide
        $typelibguid13 = "a729f9cc-edc2-4785-9a7d-7b81bb12484c" ascii nocase wide
        $typelibguid14 = "55a1fd43-d23e-4d72-aadb-bbd1340a6913" ascii nocase wide
        $typelibguid15 = "d43f240d-e7f5-43c5-9b51-d156dc7ea221" ascii nocase wide
        $typelibguid16 = "c2e6c1a0-93b1-4bbc-98e6-8e2b3145db8e" ascii nocase wide
        $typelibguid17 = "714ae6f3-0d03-4023-b753-fed6a31d95c7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_BrowserPass
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/jabiel/BrowserPass

Pattern signatures:
$typelibguid0 = "3cb59871-0dce-453b-857a-2d1e515b0b66" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_BrowserPass {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jabiel/BrowserPass"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "3cb59871-0dce-453b-857a-2d1e515b0b66" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Mythic
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/its-a-feature/Mythic

Pattern signatures:
$typelibguid0 = "91f7a9da-f045-4239-a1e9-487ffdd65986" ascii nocase wide
        $typelibguid1 = "0405205c-c2a0-4f9a-a221-48b5c70df3b6" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Mythic {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/its-a-feature/Mythic"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "91f7a9da-f045-4239-a1e9-487ffdd65986" ascii nocase wide
        $typelibguid1 = "0405205c-c2a0-4f9a-a221-48b5c70df3b6" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Nuages
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/p3nt4/Nuages

Pattern signatures:
$typelibguid0 = "e9e80ac7-4c13-45bd-9bde-ca89aadf1294" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Nuages {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/p3nt4/Nuages"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "e9e80ac7-4c13-45bd-9bde-ca89aadf1294" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpSniper
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/HunnicCyber/SharpSniper

Pattern signatures:
$typelibguid0 = "c8bb840c-04ce-4b60-a734-faf15abf7b18" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpSniper {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/HunnicCyber/SharpSniper"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "c8bb840c-04ce-4b60-a734-faf15abf7b18" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpHound3
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/BloodHoundAD/SharpHound3

Pattern signatures:
$typelibguid0 = "a517a8de-5834-411d-abda-2d0e1766539c" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpHound3 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/BloodHoundAD/SharpHound3"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "a517a8de-5834-411d-abda-2d0e1766539c" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_BlockEtw
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/Soledge/BlockEtw

Pattern signatures:
$typelibguid0 = "daedf7b3-8262-4892-adc4-425dd5f85bca" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_BlockEtw {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Soledge/BlockEtw"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "daedf7b3-8262-4892-adc4-425dd5f85bca" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpWifiGrabber
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/r3nhat/SharpWifiGrabber

Pattern signatures:
$typelibguid0 = "c0997698-2b73-4982-b25b-d0578d1323c2" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpWifiGrabber {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/r3nhat/SharpWifiGrabber"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "c0997698-2b73-4982-b25b-d0578d1323c2" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpMapExec
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/cube0x0/SharpMapExec

Pattern signatures:
$typelibguid0 = "bd5220f7-e1fb-41d2-91ec-e4c50c6e9b9f" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpMapExec {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/cube0x0/SharpMapExec"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "bd5220f7-e1fb-41d2-91ec-e4c50c6e9b9f" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_k8fly
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/zzwlpx/k8fly

Pattern signatures:
$typelibguid0 = "13b6c843-f3d4-4585-b4f3-e2672a47931e" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_k8fly {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/zzwlpx/k8fly"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "13b6c843-f3d4-4585-b4f3-e2672a47931e" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Stealer
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/malwares/Stealer

Pattern signatures:
$typelibguid0 = "8fcd4931-91a2-4e18-849b-70de34ab75df" ascii nocase wide
        $typelibguid1 = "e48811ca-8af8-4e73-85dd-2045b9cca73a" ascii nocase wide
        $typelibguid2 = "d3d8a1cc-e123-4905-b3de-374749122fcf" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Stealer {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/malwares/Stealer"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "8fcd4931-91a2-4e18-849b-70de34ab75df" ascii nocase wide
        $typelibguid1 = "e48811ca-8af8-4e73-85dd-2045b9cca73a" ascii nocase wide
        $typelibguid2 = "d3d8a1cc-e123-4905-b3de-374749122fcf" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_PortTran
Repository: Yara-Rules/rules
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/k8gege/PortTran

Pattern signatures:
$typelibguid0 = "3a074374-77e8-4312-8746-37f3cb00e82c" ascii nocase wide
        $typelibguid1 = "67a73bac-f59d-4227-9220-e20a2ef42782" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_PortTran {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/k8gege/PortTran"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "3a074374-77e8-4312-8746-37f3cb00e82c" ascii nocase wide
        $typelibguid1 = "67a73bac-f59d-4227-9220-e20a2ef42782" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_gray_keylogger_2
Repository: Yara-Rules/rules
Detects: Detects VB.NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/graysuit/gray-keylogger-2

Pattern signatures:
$typelibguid0 = "e94ca3ff-c0e5-4d1a-ad5e-f6ebbe365067" ascii nocase wide
        $typelibguid1 = "1ed07564-b411-4626-88e5-e1cd8ecd860a" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_gray_keylogger_2 {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/graysuit/gray-keylogger-2"
        author = "Arnim Rupp"
        date = "2020-12-30"
    strings:
        $typelibguid0 = "e94ca3ff-c0e5-4d1a-ad5e-f6ebbe365067" ascii nocase wide
        $typelibguid1 = "1ed07564-b411-4626-88e5-e1cd8ecd860a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Lime_Miner
Repository: Yara-Rules/rules
Detects: Detects VB.NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/NYAN-x-CAT/Lime-Miner

Pattern signatures:
$typelibguid0 = "13958fb9-dfc1-4e2c-8a8d-a5e68abdbc66" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Lime_Miner {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/Lime-Miner"
        author = "Arnim Rupp"
        date = "2020-12-30"
    strings:
        $typelibguid0 = "13958fb9-dfc1-4e2c-8a8d-a5e68abdbc66" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_BlackNET
Repository: Yara-Rules/rules
Detects: Detects VB.NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/BlackHacker511/BlackNET

Pattern signatures:
$typelibguid0 = "c2b90883-abee-4cfa-af66-dfd93ec617a5" ascii nocase wide
        $typelibguid1 = "8bb6f5b4-e7c7-4554-afd1-48f368774837" ascii nocase wide
        $typelibguid2 = "983ae28c-91c3-4072-8cdf-698b2ff7a967" ascii nocase wide
        $typelibguid3 = "9ac18cdc-3711-4719-9cfb-5b5f2d51fd5a" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_BlackNET {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/BlackHacker511/BlackNET"
        author = "Arnim Rupp"
        date = "2020-12-30"
    strings:
        $typelibguid0 = "c2b90883-abee-4cfa-af66-dfd93ec617a5" ascii nocase wide
        $typelibguid1 = "8bb6f5b4-e7c7-4554-afd1-48f368774837" ascii nocase wide
        $typelibguid2 = "983ae28c-91c3-4072-8cdf-698b2ff7a967" ascii nocase wide
        $typelibguid3 = "9ac18cdc-3711-4719-9cfb-5b5f2d51fd5a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_PlasmaRAT
Repository: Yara-Rules/rules
Detects: Detects VB.NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/mwsrc/PlasmaRAT

Pattern signatures:
$typelibguid0 = "b8a2147c-074c-46e1-bb99-c8431a6546ce" ascii nocase wide
        $typelibguid1 = "0fcfde33-213f-4fb6-ac15-efb20393d4f3" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_PlasmaRAT {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/mwsrc/PlasmaRAT"
        author = "Arnim Rupp"
        date = "2020-12-30"
    strings:
        $typelibguid0 = "b8a2147c-074c-46e1-bb99-c8431a6546ce" ascii nocase wide
        $typelibguid1 = "0fcfde33-213f-4fb6-ac15-efb20393d4f3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_njRAT
Repository: Yara-Rules/rules
Detects: Detects VB.NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/mwsrc/njRAT

Pattern signatures:
$typelibguid0 = "5a542c1b-2d36-4c31-b039-26a88d3967da" ascii nocase wide
        $typelibguid1 = "6b07082a-9256-42c3-999a-665e9de49f33" ascii nocase wide
        $typelibguid2 = "c0a9a70f-63e8-42ca-965d-73a1bc903e62" ascii nocase wide
        $typelibguid3 = "70bd11de-7da1-4a89-b459-8daacc930c20" ascii nocase wide
        $typelibguid4 = "fc790ee5-163a-40f9-a1e2-9863c290ff8b" ascii nocase wide
        $typelibguid5 = "cb3c28b2-2a4f-4114-941c-ce929fec94d3" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_njRAT {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/mwsrc/njRAT"
        author = "Arnim Rupp"
        date = "2020-12-30"
    strings:
        $typelibguid0 = "5a542c1b-2d36-4c31-b039-26a88d3967da" ascii nocase wide
        $typelibguid1 = "6b07082a-9256-42c3-999a-665e9de49f33" ascii nocase wide
        $typelibguid2 = "c0a9a70f-63e8-42ca-965d-73a1bc903e62" ascii nocase wide
        $typelibguid3 = "70bd11de-7da1-4a89-b459-8daacc930c20" ascii nocase wide
        $typelibguid4 = "fc790ee5-163a-40f9-a1e2-9863c290ff8b" ascii nocase wide
        $typelibguid5 = "cb3c28b2-2a4f-4114-941c-ce929fec94d3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Manager
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via typelibguid
Author: Arnim Rupp
Reference: https://github.com/TheWover/Manager

Pattern signatures:
$typelibguid0 = "dda73ee9-0f41-4c09-9cad-8215abd60b33" ascii nocase wide
        $typelibguid1 = "6a0f2422-d4d1-4b7e-84ad-56dc0fd2dfc5" ascii nocase wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Manager {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/TheWover/Manager"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "dda73ee9-0f41-4c09-9cad-8215abd60b33" ascii nocase wide
        $typelibguid1 = "6a0f2422-d4d1-4b7e-84ad-56dc0fd2dfc5" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}