Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies the execution of specialized Red and Black team .NET tools by analyzing unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these artifacts allows the SOC to distinguish between authorized security testing activities and potential adversary use of similar legitimate utilities to mask malicious operations.

YARA Rule

rule HKTL_NET_GUID_Manager {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/TheWover/Manager"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "dda73ee9-0f41-4c09-9cad-8215abd60b33" ascii nocase wide
        $typelibguid1 = "6a0f2422-d4d1-4b7e-84ad-56dc0fd2dfc5" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/TheWover/Manager
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects .NET red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Backup Agents Running on Domain Controllers

  • Context: Enterprise backup solutions like Veeam Agent for Microsoft Windows or Rubrik often utilize .NET components to interact with the OS registry and file system. These agents frequently load specific TypeLib GUIDs during their scheduled daily backup windows, which can mimic the behavior of red-team tools scanning the environment.
  • Suggested Filter/Exclusion: Exclude processes where ProcessName matches VeeamAgent.exe, RubrikService.exe, or BackupEngine.exe AND the execution occurs within a defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Application Deployment

  • Context: When SCCM deploys .NET-based applications or updates to endpoints, the client service (ccmsetup.exe or CcmExec) often instantiates .NET assemblies with unique TypeLib GUIDs. This is common during large-scale patching cycles and can be misidentified as a reconnaissance tool probing for application inventory.
  • Suggested Filter/Exclusion: Create an exclusion rule where the parent process is ccmexec.exe or WUAHandler.exe, specifically filtering out TypeLib GUIDs associated with known SCCM deployment packages (e.g., those containing “Microsoft.ConfigurationManagement” in their assembly name).

• Scenario: Internal DevOps CI/CD Pipeline Execution

  • Context: Build servers running Azure DevOps Agents or Jenkins on Windows often execute .NET scripts to compile code, run unit tests, or manage artifacts. These agents load standard .NET TypeLibs that