Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting the execution of known Red and Black team .NET tools through their unique TypeLibGUID signatures within Azure Sentinel. Proactive hunting for these indicators is essential to distinguish legitimate security operations from malicious tool usage that may mimic trusted administrative processes, thereby reducing false positives and uncovering stealthy reconnaissance efforts.

YARA Rule

rule HKTL_NET_GUID_donut {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/TheWover/donut"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "98ca74c7-a074-434d-9772-75896e73ceaa" ascii nocase wide
        $typelibguid1 = "3c9a6b88-bed2-4ba8-964c-77ec29bf1846" ascii nocase wide
        $typelibguid2 = "4fcdf3a3-aeef-43ea-9297-0d3bde3bdad2" ascii nocase wide
        $typelibguid3 = "361c69f5-7885-4931-949a-b91eeab170e3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://github.com/TheWover/donut
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects .NET red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build servers (e.g., Jenkins, Azure DevOps) frequently execute .NET-based automation scripts or deployment agents that load specific COM libraries. These agents often utilize standard Red/Blue team tool typelibguids to manage artifact signing or container orchestration during nightly builds.
  • Filter/Exclusion: Exclude processes running under the SYSTEM account on known CI/CD server hostnames (e.g., Jenkins-Server-01, ADO-Build-Pool). Additionally, filter out executions where the parent process is a recognized build agent (e.g., dotnet.exe, msbuild.exe) rather than an interactive user shell.

• Scenario: Enterprise Endpoint Management & Patching

  • Context: Unified Endpoint Management (UEM) solutions like Microsoft Intune or SCCM often deploy .NET-based inventory agents and patch management tools. These agents utilize specific typelibguids to query hardware, software inventories, and security configurations on endpoints, mimicking the behavior of Red-team reconnaissance tools.
  • Filter/Exclusion: Create an exclusion for processes where the ImageName matches known UEM agents (e.g., ccmexec.exe, IntuneManagementExtension.exe) and the execution occurs during defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Scheduled Antivirus & EDR Heuristic Scans

  • Context: Modern Endpoint Detection and Response (EDR) platforms, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, utilize .NET components to perform deep heuristic scans. These internal scanning engines often load typ