Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies adversary activity by detecting the presence of known .NET-based red and blue team tools through their unique typelibguid signatures within Azure Sentinel logs. Proactive hunting for these indicators is essential to distinguish legitimate security testing from potential malicious reconnaissance or tool deployment by attackers leveraging similar .NET frameworks in the environment.

YARA Rule

rule HKTL_NET_GUID_neo_ConfuserEx {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/XenocodeRCE/neo-ConfuserEx"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "e98490bb-63e5-492d-b14e-304de928f81a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/XenocodeRCE/neo-ConfuserEx
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects .NET red/black-team tools via typelibguid rule, including suggested filters and exclusions:

• Scenario: Microsoft System Center Configuration Manager (SCCM) Client Updates

  • Context: The SCCM client (ccmexec.exe) frequently loads .NET assemblies during software deployment or inventory cycles. These operations often instantiate specific COM objects with unique typelibguid values that mimic the signatures of Red Team tools like Cobalt Strike’s Beacon or custom C2 frameworks.
  • Filter/Exclusion: Create a filter to exclude processes where the executable path matches C:\Program Files (x86)\Microsoft Configuration Manager\ccmexec.exe and the parent process is ccmsetup.exe.

• Scenario: Automated PowerShell Scheduled Tasks for Patch Management

  • Context: Enterprise IT operations often run scheduled PowerShell jobs (powershell.exe) that utilize .NET libraries to query Active Directory or manage patches. These scripts may dynamically load typelibs associated with security monitoring tools, triggering the rule when they interact with system management APIs.
  • Filter/Exclusion: Exclude events where the command line contains specific keywords like Invoke-Command, Get-HotFix, or Update-Module and the process name is powershell.exe running under a known service account (e.g., DOMAIN\svc-patch).

• Scenario: Microsoft Defender for Endpoint (MDE) Sensor Updates

  • Context: The MDE sensor (MsSenseService.exe) or the Antimalware Service (Antimalware.exe) performs regular self-checks and telemetry uploads using .NET components. These internal health checks often generate typelibguid entries that overlap with those used by Blue Team analysis tools (e.g., Velociraptor).
  • **Filter/Ex