Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting the usage of specific .NET-based Red and Black team tools through their unique typelib GUID signatures within Azure Sentinel. Proactive hunting for these indicators is essential to distinguish legitimate security operations from stealthy threat actor movements that leverage similar .NET frameworks to evade standard detection mechanisms.

YARA Rule

rule HKTL_NET_GUID_MemeVM {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/TobitoFatitoRE/MemeVM"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "ef18f7f2-1f03-481c-98f9-4a18a2f12c11" ascii nocase wide
        $typelibguid1 = "77b2c83b-ca34-4738-9384-c52f0121647c" ascii nocase wide
        $typelibguid2 = "14d5d12e-9a32-4516-904e-df3393626317" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://github.com/TobitoFatitoRE/MemeVM
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Automated Backup Agent Execution

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik utilize .NET assemblies to manage agent communications. During scheduled backup windows, these agents instantiate specific COM objects that generate typelibguid entries matching those of security testing tools (e.g., similar GUIDs used by Mimikatz or SharpUp).
  • Suggested Filter/Exclusion: Create an exclusion based on the process image path and parent process.
    • Filter: ProcessImageName IN ('VeeamAgent.exe', 'rubrik-agent.exe') AND ParentImageName = 'BackupService.exe'.

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Context: The Microsoft SCCM/MECM client (ccmexec.exe) frequently runs .NET-based maintenance tasks to inventory hardware or deploy software updates. These tasks often load .NET libraries that register type libraries with GUIDs overlapping with common red-team tools like SharpHunt or Bloodhound.
  • Suggested Filter/Exclusion: Exclude events where the process owner is a known system service account and the execution occurs during standard maintenance windows.
    • Filter: ProcessImageName = 'ccmexec.exe' AND StartTime BETWEEN '02:00' AND '06:00'.

• Scenario: Active Directory Password Policy Enforcement via PowerShell

  • Context: IT administrators often run scheduled PowerShell scripts using the .NET Framework to enforce password policies or reset user accounts. These scripts invoke .NET assemblies (e.g., System.DirectoryServices.AccountManagement) which