Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging custom or known .NET-based offensive and defensive tools that register unique TypeLib GUIDs to establish persistence or execute reconnaissance within the environment. A SOC team should proactively hunt for these indicators in Azure Sentinel because standard signature-based detections often miss novel tooling, making the identification of anomalous TypeLib registrations a critical early-warning signal for potential red-team exercises or stealthy attacker activity.

YARA Rule

rule HKTL_NET_GUID_ADSearch {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/tomcarver16/ADSearch"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "4da5f1b7-8936-4413-91f7-57d6e072b4a7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/tomcarver16/ADSearch
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/black-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize .NET-based agents that load specific TypeLib GUIDs during scheduled nightly jobs to manage inventory or perform agent health checks. These legitimate processes mimic the behavior of red-team tools like SharpUp or BloodHound.
  • Filter/Exclusion: Exclude alerts where the parent process is a known backup service (e.g., Veeam.Backup.Service.exe, commvault.cmd) and the execution time aligns with defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Updates

  • Context: During software deployment or OS patching cycles, SCCM clients execute .NET wrappers that instantiate TypeLib GUIDs to query system configuration. This is frequently triggered by the ccmexec.exe process launching temporary .NET assemblies for inventory collection.
  • Filter/Exclusion: Create a rule exclusion based on the parent image path containing \Microsoft Endpoint\ or C:\Program Files (x86)\Microsoft Configuration Manager\, specifically targeting the TypeLib GUIDs associated with standard SCCM components rather than red-team specific ones.

• Scenario: Active Directory Health Monitoring Tools

  • Context: Internal IT operations teams often run scheduled PowerShell scripts using .NET libraries to monitor AD health, replicate data, or manage Group Policy. These scripts may utilize TypeLib GUIDs identical to those used by tools like SharpView or PowerSploit.
  • Filter/Exclusion: Filter out events where the command