Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies the execution of specialized .NET-based red and blue team tools by analyzing unique TypelibGUID signatures within process events. Proactive hunting for these indicators in Azure Sentinel is essential to distinguish legitimate security testing activities from potential adversary use of similar .NET frameworks for stealthy reconnaissance or post-exploitation operations.

YARA Rule

rule HKTL_NET_GUID_Driver_Template {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/FuzzySecurity/Driver-Template"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "bdb79ad6-639f-4dc2-8b8a-cd9107da3d69" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/FuzzySecurity/Driver-Template
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects .NET red/black-team tools via typelibguid,” along with suggested filters or exclusions:

• Scenario: Automated Backup and Maintenance Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize .NET assemblies to manage agent communication or perform inventory scans. These processes may register specific typelibguid values that overlap with security tool signatures during scheduled maintenance windows.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name (e.g., Veeam.Backup.Service.exe, commvault.cmd) and restrict detection to business hours or specific backup windows, excluding off-hours execution of these known services.

• Scenario: Endpoint Detection and Response (EDR) Self-Scanning

  • Context: Native EDR agents like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently load .NET components for real-time telemetry collection and threat hunting modules. The agent’s internal updater or sensor service may trigger the typelibguid signature when initializing a new session or updating its definition database.
  • Suggested Filter/Exclusion: Exclude events where the Parent Process is the EDR service itself (e.g., FalconSensorService.exe, MsMpEng.exe) or filter by Process Path to ensure only processes running from trusted vendor installation directories are analyzed.

• Scenario: Office 365/Teams Background Synchronization

  • Context: The Microsoft Teams and Outlook desktop clients rely heavily on .NET frameworks for plugin management and add-in registration. When a user launches Teams or updates an Outlook add-in, the application registers type libraries that match the detection logic’s typelibguid patterns.
  • Suggested Filter/Exclusion: Implement a filter excluding processes with