deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_GUID_KeeThief
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/GhostPack/KeeThief

Pattern signatures:
$typelibguid1lo = "39aa6f93-a1c9-497f-bad2-cc42a61d5710" ascii wide
        $typelibguid3lo = "3fca8012-3bad-41e4-91f4-534aa9a44f96" ascii wide
        $typelibguid4lo = "ea92f1e6-3f34-48f8-8b0a-f2bbc19220ef" ascii wide
        $typelibguid5lo = "c23b51c4-2475-4fc6-9b3a-27d0a2b99b0f" ascii wide
        /* $typelibguid6 = "94432a8e-3e06-4776-b9b2-3684a62bb96a" ascii nocase wide FIX FPS with Microsoft files */ 
        $typelibguid7lo = "80ba63a4-7d41-40e9-a722-6dd58b28bf7e" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_KeeThief {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/KeeThief"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "71fef0e9-223a-5834-9d1c-f3fb8b66a809"
    strings:
        $typelibguid1lo = "39aa6f93-a1c9-497f-bad2-cc42a61d5710" ascii wide
        $typelibguid3lo = "3fca8012-3bad-41e4-91f4-534aa9a44f96" ascii wide
        $typelibguid4lo = "ea92f1e6-3f34-48f8-8b0a-f2bbc19220ef" ascii wide
        $typelibguid5lo = "c23b51c4-2475-4fc6-9b3a-27d0a2b99b0f" ascii wide
        /* $typelibguid6 = "94432a8e-3e06-4776-b9b2-3684a62bb96a" ascii nocase wide FIX FPS with Microsoft files */ 
        $typelibguid7lo = "80ba63a4-7d41-40e9-a722-6dd58b28bf7e" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_fakelogonscreen
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/bitsadmin/fakelogonscreen

Pattern signatures:
$typelibguid0lo = "d35a55bd-3189-498b-b72f-dc798172e505" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_fakelogonscreen {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/bitsadmin/fakelogonscreen"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "cc20290c-3f34-5e81-9337-c582f1ee7ade"
    strings:
        $typelibguid0lo = "d35a55bd-3189-498b-b72f-dc798172e505" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_PoshSecFramework
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/PoshSec/PoshSecFramework

Pattern signatures:
$typelibguid0lo = "b1ac6aa0-2f1a-4696-bf4b-0e41cf2f4b6b" ascii wide
        $typelibguid1lo = "78bfcfc2-ef1c-4514-bce6-934b251666d2" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_PoshSecFramework {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/PoshSec/PoshSecFramework"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "a91620f3-3f21-525a-bc87-94d21cd126be"
    strings:
        $typelibguid0lo = "b1ac6aa0-2f1a-4696-bf4b-0e41cf2f4b6b" ascii wide
        $typelibguid1lo = "78bfcfc2-ef1c-4514-bce6-934b251666d2" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpAttack
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/jaredhaight/SharpAttack

Pattern signatures:
$typelibguid0lo = "5f0ceca3-5997-406c-adf5-6c7fbb6cba17" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpAttack {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jaredhaight/SharpAttack"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "1eb911ab-3fb9-54b7-8afb-66328f30d563"
    strings:
        $typelibguid0lo = "5f0ceca3-5997-406c-adf5-6c7fbb6cba17" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_BrowserPass
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/jabiel/BrowserPass

Pattern signatures:
$typelibguid0lo = "3cb59871-0dce-453b-857a-2d1e515b0b66" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_BrowserPass {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jabiel/BrowserPass"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-28"
        modified = "2025-08-15"
        id = "bad36c36-dbed-527c-a2f5-4dceff1abe4b"
    strings:
        $typelibguid0lo = "3cb59871-0dce-453b-857a-2d1e515b0b66" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Mythic
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/its-a-feature/Mythic

Pattern signatures:
$typelibguid0lo = "91f7a9da-f045-4239-a1e9-487ffdd65986" ascii wide
        $typelibguid1lo = "0405205c-c2a0-4f9a-a221-48b5c70df3b6" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Mythic {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/its-a-feature/Mythic"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-29"
        modified = "2025-08-15"
        id = "44237fac-1526-5587-83a1-61d7a54f7da9"
    strings:
        $typelibguid0lo = "91f7a9da-f045-4239-a1e9-487ffdd65986" ascii wide
        $typelibguid1lo = "0405205c-c2a0-4f9a-a221-48b5c70df3b6" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Nuages
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/p3nt4/Nuages

Pattern signatures:
$typelibguid0lo = "e9e80ac7-4c13-45bd-9bde-ca89aadf1294" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Nuages {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/p3nt4/Nuages"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-29"
        modified = "2025-08-15"
        id = "5ad947e2-bd71-50d4-9bbf-4d018c7ff36a"
    strings:
        $typelibguid0lo = "e9e80ac7-4c13-45bd-9bde-ca89aadf1294" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpSniper
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/HunnicCyber/SharpSniper

Pattern signatures:
$typelibguid0lo = "c8bb840c-04ce-4b60-a734-faf15abf7b18" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpSniper {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/HunnicCyber/SharpSniper"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-29"
        modified = "2025-08-15"
        id = "14e6a3b8-5e1f-5dd8-9b51-22522ac317e7"
    strings:
        $typelibguid0lo = "c8bb840c-04ce-4b60-a734-faf15abf7b18" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpHound3
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/BloodHoundAD/SharpHound3

Pattern signatures:
$typelibguid0lo = "a517a8de-5834-411d-abda-2d0e1766539c" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpHound3 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/BloodHoundAD/SharpHound3"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-29"
        modified = "2025-08-15"
        id = "58001912-88a1-527d-9d3e-d7c376a1fce4"
    strings:
        $typelibguid0lo = "a517a8de-5834-411d-abda-2d0e1766539c" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_BlockEtw
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/Soledge/BlockEtw

Pattern signatures:
$typelibguid0lo = "daedf7b3-8262-4892-adc4-425dd5f85bca" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_BlockEtw {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Soledge/BlockEtw"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-29"
        modified = "2025-08-15"
        id = "c2b72fef-6549-5b53-8ccf-232e8d152e96"
    strings:
        $typelibguid0lo = "daedf7b3-8262-4892-adc4-425dd5f85bca" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpWifiGrabber
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/r3nhat/SharpWifiGrabber

Pattern signatures:
$typelibguid0lo = "c0997698-2b73-4982-b25b-d0578d1323c2" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpWifiGrabber {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/r3nhat/SharpWifiGrabber"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-29"
        modified = "2025-08-15"
        id = "1a457672-743c-56f0-a4d7-6c25f9ce2345"
    strings:
        $typelibguid0lo = "c0997698-2b73-4982-b25b-d0578d1323c2" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_SharpMapExec
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/cube0x0/SharpMapExec

Pattern signatures:
$typelibguid0lo = "bd5220f7-e1fb-41d2-91ec-e4c50c6e9b9f" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_SharpMapExec {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/cube0x0/SharpMapExec"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-29"
        modified = "2025-08-15"
        id = "b4922734-a486-5c4d-9bd7-5146cfecbf01"
    strings:
        $typelibguid0lo = "bd5220f7-e1fb-41d2-91ec-e4c50c6e9b9f" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_k8fly
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/zzwlpx/k8fly

Pattern signatures:
$typelibguid0lo = "13b6c843-f3d4-4585-b4f3-e2672a47931e" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_k8fly {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/zzwlpx/k8fly"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-29"
        modified = "2025-08-15"
        id = "3421e6fb-df65-5e2e-ae46-37f9c763c6a1"
    strings:
        $typelibguid0lo = "13b6c843-f3d4-4585-b4f3-e2672a47931e" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Stealer
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/malwares/Stealer

Pattern signatures:
$typelibguid0lo = "8fcd4931-91a2-4e18-849b-70de34ab75df" ascii wide
        $typelibguid1lo = "e48811ca-8af8-4e73-85dd-2045b9cca73a" ascii wide
        $typelibguid2lo = "d3d8a1cc-e123-4905-b3de-374749122fcf" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Stealer {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/malwares/Stealer"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-29"
        modified = "2025-08-15"
        id = "c721a0ac-e898-52aa-9bdf-a19bc0bd783d"
    strings:
        $typelibguid0lo = "8fcd4931-91a2-4e18-849b-70de34ab75df" ascii wide
        $typelibguid1lo = "e48811ca-8af8-4e73-85dd-2045b9cca73a" ascii wide
        $typelibguid2lo = "d3d8a1cc-e123-4905-b3de-374749122fcf" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_PortTran
Repository: Neo23x0/signature-base
Detects: Detects c# red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/k8gege/PortTran

Pattern signatures:
$typelibguid0lo = "3a074374-77e8-4312-8746-37f3cb00e82c" ascii wide
        $typelibguid1lo = "67a73bac-f59d-4227-9220-e20a2ef42782" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_PortTran {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/k8gege/PortTran"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-29"
        modified = "2025-08-15"
        id = "844e58a2-54f5-51e8-8176-6a478a136603"
    strings:
        $typelibguid0lo = "3a074374-77e8-4312-8746-37f3cb00e82c" ascii wide
        $typelibguid1lo = "67a73bac-f59d-4227-9220-e20a2ef42782" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_gray_keylogger_2
Repository: Neo23x0/signature-base
Detects: Detects VB.NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/graysuit/gray-keylogger-2

Pattern signatures:
$typelibguid0lo = "e94ca3ff-c0e5-4d1a-ad5e-f6ebbe365067" ascii wide
        $typelibguid1lo = "1ed07564-b411-4626-88e5-e1cd8ecd860a" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_gray_keylogger_2 {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/graysuit/gray-keylogger-2"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-30"
        modified = "2025-08-15"
        id = "40ab8103-9151-5a5c-8b70-ab3bfd3896f9"
    strings:
        $typelibguid0lo = "e94ca3ff-c0e5-4d1a-ad5e-f6ebbe365067" ascii wide
        $typelibguid1lo = "1ed07564-b411-4626-88e5-e1cd8ecd860a" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_Lime_Miner
Repository: Neo23x0/signature-base
Detects: Detects VB.NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/NYAN-x-CAT/Lime-Miner

Pattern signatures:
$typelibguid0lo = "13958fb9-dfc1-4e2c-8a8d-a5e68abdbc66" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_Lime_Miner {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/Lime-Miner"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-30"
        modified = "2025-08-15"
        id = "d0631817-10a2-55bf-a41d-226fa0dcb9f9"
    strings:
        $typelibguid0lo = "13958fb9-dfc1-4e2c-8a8d-a5e68abdbc66" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_BlackNET
Repository: Neo23x0/signature-base
Detects: Detects VB.NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/BlackHacker511/BlackNET

Pattern signatures:
$typelibguid0lo = "c2b90883-abee-4cfa-af66-dfd93ec617a5" ascii wide
        $typelibguid1lo = "8bb6f5b4-e7c7-4554-afd1-48f368774837" ascii wide
        $typelibguid2lo = "983ae28c-91c3-4072-8cdf-698b2ff7a967" ascii wide
        $typelibguid3lo = "9ac18cdc-3711-4719-9cfb-5b5f2d51fd5a" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_BlackNET {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/BlackHacker511/BlackNET"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-30"
        modified = "2025-08-15"
        id = "9fbb3c11-7b11-5910-9c8b-247aeefbaa87"
    strings:
        $typelibguid0lo = "c2b90883-abee-4cfa-af66-dfd93ec617a5" ascii wide
        $typelibguid1lo = "8bb6f5b4-e7c7-4554-afd1-48f368774837" ascii wide
        $typelibguid2lo = "983ae28c-91c3-4072-8cdf-698b2ff7a967" ascii wide
        $typelibguid3lo = "9ac18cdc-3711-4719-9cfb-5b5f2d51fd5a" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
YARA Detection Rule: HKTL_NET_GUID_PlasmaRAT
Repository: Neo23x0/signature-base
Detects: Detects VB.NET red/black-team tools via typelibguid
Author: Arnim Rupp (https://github.com/ruppde)
Reference: https://github.com/mwsrc/PlasmaRAT

Pattern signatures:
$typelibguid0lo = "b8a2147c-074c-46e1-bb99-c8431a6546ce" ascii wide
        $typelibguid1lo = "0fcfde33-213f-4fb6-ac15-efb20393d4f3" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them

Full rule:
rule HKTL_NET_GUID_PlasmaRAT {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/mwsrc/PlasmaRAT"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2020-12-30"
        modified = "2025-08-15"
        id = "13362cba-f9b2-50c8-95cc-504e585bdd42"
    strings:
        $typelibguid0lo = "b8a2147c-074c-46e1-bb99-c8431a6546ce" ascii wide
        $typelibguid1lo = "0fcfde33-213f-4fb6-ac15-efb20393d4f3" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}