Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This detection rule identifies the execution of specialized .NET-based security testing tools by monitoring unique typelibguid signatures often utilized during red and black team engagements. A proactive hunt for these artifacts in Azure Sentinel is essential to distinguish legitimate security assessments from potential adversary activity that mimics standard .NET tooling to evade traditional signature-based defenses.

YARA Rule

rule HKTL_NET_GUID_DotNetToJScript_LanguageModeBreakout {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "deadb33f-fa94-41b5-813d-e72d8677a0cf" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/black-team tools via typelibguid,” along with suggested filters or exclusions:

• Scenario: Automated Deployment via PowerShell DSC

  • Context: The enterprise utilizes Windows Desired State Configuration (DSC) to manage server configurations. When DSC compiles and executes .psd1 configuration files, it invokes the .NET runtime which registers specific TypeLibGUIDs associated with the Microsoft.Powershell.Dsc assembly. This mimics the behavior of red-team tools like SharpUp or PowerSploit.
  • Suggested Filter: Exclude processes where the parent process is powershell.exe running under a scheduled task named “DSC-Configuration” and the file path contains \Windows\System32\WindowsPowerShell\v1.0.

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Context: During routine client health checks or software deployment cycles, the SCCM client (ccmexec.exe) launches .NET-based agents to inventory hardware and software. These agents often load TypeLibGUIDs associated with the Microsoft.ConfigurationManagement namespace, which can overlap with black-team tools like BloodHound collectors or SharpUp.
  • Suggested Filter: Create an exclusion for processes where the command line contains “ccmexec.exe” and the image path is located within C:\Program Files (x86)\Microsoft Configuration Manager\.

• Scenario: Scheduled Backup Jobs Using Veeam or Commvault

  • Context: Enterprise backup solutions like Veeam Backup & Replication utilize .NET agents to scan volumes and manage snapshots. The agent process (VeeamAgent.exe) frequently instantiates TypeLibGUIDs related to Veeam.Backup which share structural similarities with red-team