Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Suite

Detects c# red/black-team tools via typelibguid

Hack toolSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Arnim Rupp (https://github.com/ruppde)
Date
2020-12-13
Modified
2025-08-15
Score / Quality
75 / 83

What this rule detects

Detects c# red/black-team tools via typelibguid

Targets: Windows PE.

It defines 21 patterns (21 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
hktl-net-guid-sharp-suite.yarDetection Rule License 1.1
rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Suite : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ab3cf358-a41d-584d-baaf-5e8f7232ca85"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/FuzzySecurity/Sharp-Suite"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1562-L1596"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "cffb4eae9fe3f2034fb03defcd0e0f3f1abaaa2638b137bdfdf67d071e055d42"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"

	strings:
		$typelibguid0lo = "19657be4-51ca-4a85-8ab1-f6666008b1f3" ascii wide
		$typelibguid1lo = "0a382d9a-897f-431a-81c2-a4e08392c587" ascii wide
		$typelibguid2lo = "467ee2a9-2f01-4a71-9647-2a2d9c31e608" ascii wide
		$typelibguid3lo = "eacaa2b8-43e5-4888-826d-2f6902e16546" ascii wide
		$typelibguid4lo = "629f86e6-44fe-4c9c-b043-1c9b64be6d5a" ascii wide
		$typelibguid5lo = "ecf2ffe4-1744-4745-8693-5790d66bb1b8" ascii wide
		$typelibguid6lo = "0a621f4c-8082-4c30-b131-ba2c98db0533" ascii wide
		$typelibguid7lo = "72019dfe-608e-4ab2-a8f1-66c95c425620" ascii wide
		$typelibguid8lo = "f0d28809-b712-4380-9a59-407b7b2badd5" ascii wide
		$typelibguid9lo = "956a5a4d-2007-4857-9259-51cd0fb5312a" ascii wide
		$typelibguid10lo = "a3b7c697-4bb6-455d-9fda-4ab54ae4c8d2" ascii wide
		$typelibguid11lo = "a5f883ce-1f96-4456-bb35-40229191420c" ascii wide
		$typelibguid12lo = "28978103-d90d-4618-b22e-222727f40313" ascii wide
		$typelibguid13lo = "0c70c839-9565-4881-8ea1-408c1ebe38ce" ascii wide
		$typelibguid14lo = "fa1d9a36-415a-4855-8c01-54b6e9fc6965" ascii wide
		$typelibguid15lo = "252676f8-8a19-4664-bfb8-5a947e48c32a" ascii wide
		$typelibguid16lo = "447edefc-b429-42bc-b3bc-63a9af19dbd6" ascii wide
		$typelibguid17lo = "04d0b3a6-eaab-413d-b9e2-512fa8ebd02f" ascii wide
		$typelibguid18lo = "5611236e-2557-45b8-be29-5d1f074d199e" ascii wide
		$typelibguid19lo = "53f622eb-0ca3-4e9b-9dc8-30c832df1c7b" ascii wide
		$typelibguid20lo = "414187db-5feb-43e5-a383-caa48b5395f1" ascii wide

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

Strings (21 patterns)

IdentifierTypeValueModifiers
$typelibguid0lotext"19657be4-51ca-4a85-8ab1-f6666008b1f3"ascii wide
$typelibguid1lotext"0a382d9a-897f-431a-81c2-a4e08392c587"ascii wide
$typelibguid2lotext"467ee2a9-2f01-4a71-9647-2a2d9c31e608"ascii wide
$typelibguid3lotext"eacaa2b8-43e5-4888-826d-2f6902e16546"ascii wide
$typelibguid4lotext"629f86e6-44fe-4c9c-b043-1c9b64be6d5a"ascii wide
$typelibguid5lotext"ecf2ffe4-1744-4745-8693-5790d66bb1b8"ascii wide
$typelibguid6lotext"0a621f4c-8082-4c30-b131-ba2c98db0533"ascii wide
$typelibguid7lotext"72019dfe-608e-4ab2-a8f1-66c95c425620"ascii wide
$typelibguid8lotext"f0d28809-b712-4380-9a59-407b7b2badd5"ascii wide
$typelibguid9lotext"956a5a4d-2007-4857-9259-51cd0fb5312a"ascii wide
$typelibguid10lotext"a3b7c697-4bb6-455d-9fda-4ab54ae4c8d2"ascii wide
$typelibguid11lotext"a5f883ce-1f96-4456-bb35-40229191420c"ascii wide
$typelibguid12lotext"28978103-d90d-4618-b22e-222727f40313"ascii wide
$typelibguid13lotext"0c70c839-9565-4881-8ea1-408c1ebe38ce"ascii wide
$typelibguid14lotext"fa1d9a36-415a-4855-8c01-54b6e9fc6965"ascii wide
$typelibguid15lotext"252676f8-8a19-4664-bfb8-5a947e48c32a"ascii wide
$typelibguid16lotext"447edefc-b429-42bc-b3bc-63a9af19dbd6"ascii wide
$typelibguid17lotext"04d0b3a6-eaab-413d-b9e2-512fa8ebd02f"ascii wide
$typelibguid18lotext"5611236e-2557-45b8-be29-5d1f074d199e"ascii wide
$typelibguid19lotext"53f622eb-0ca3-4e9b-9dc8-30c832df1c7b"ascii wide
$typelibguid20lotext"414187db-5feb-43e5-a383-caa48b5395f1"ascii wide

Condition

( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least one pattern in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: Arnim Rupp (https://github.com/ruppde)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (stated in the rule's own meta)

“Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: ab3cf358-a41d-584d-baaf-5e8f7232ca85

Tags:FILE

Related rules