Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for specific TypeLibGUID signatures associated with known .NET-based red and black team reconnaissance or exploitation tools. Proactively hunting for these indicators in Azure Sentinel is essential to uncover stealthy tool usage that may bypass traditional signature-based defenses, enabling the SOC team to validate legitimate administrative actions against suspicious lateral movement or post-exploitation behaviors.

YARA Rule

rule HKTL_NET_GUID_CVE_2020_1206_POC {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/ZecOps/CVE-2020-1206-POC"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "3523ca04-a12d-4b40-8837-1a1d28ef96de" ascii nocase wide
        $typelibguid1 = "d3a2f24a-ddc6-4548-9b3d-470e70dbcaab" ascii nocase wide
        $typelibguid2 = "fb30ee05-4a35-45f7-9a0a-829aec7e47d9" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://github.com/ZecOps/CVE-2020-1206-POC
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects .NET red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Patch Management Deployment

  • Context: Enterprise patch management solutions like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons utilize .NET assemblies to deploy updates. During the installation phase of a new patch cycle, these agents often load specific .NET typelibs that match known red-team tool signatures as part of their standard update mechanism.
  • Filter/Exclusion: Create an exclusion for processes originating from C:\Program Files\Microsoft Configuration Manager or C:\Program Files\Ivanti. Filter by process name ccmsetup.exe and ivantsvc.exe, excluding events where the parent process is a known service host (svchost.exe) with a specific Service ID.

• Scenario: Scheduled PowerShell Health Checks

  • Context: IT Operations teams often run scheduled PowerShell scripts (e.g., HealthCheck.ps1) via Task Scheduler to monitor server performance or backup status. These scripts frequently reference .NET libraries for reporting, generating typelib GUIDs that overlap with security tool signatures used by red teams for reconnaissance.
  • Filter/Exclusion: Exclude events where the process path matches C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe and the command line contains specific keywords like -File "HealthCheck.ps1". Additionally, filter out executions occurring during defined maintenance windows (e.g., 02:00–04:00 AM) on non-workstation assets.

• Scenario: Endpoint Detection and Response (EDR) Scans

  • Context: Native EDR agents such as CrowdStrike Falcon, **Microsoft Defender