Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for specific TypeLibGUID signatures associated with common .NET-based Red and Blue team reconnaissance or exploitation tools. Proactively hunting for these indicators in Azure Sentinel allows the SOC to distinguish between legitimate security operations and malicious tool usage that may be masquerading as standard administrative tasks, thereby reducing false positives while uncovering stealthy threat actor movements.

YARA Rule

rule HKTL_NET_GUID_SharpAllowedToAct {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/pkb1s/SharpAllowedToAct"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "dac5448a-4ad1-490a-846a-18e4e3e0cf9a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects .NET red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

Scenario: Microsoft Defender Antivirus Real-Time Protection Scans
- Context: The MsMpEng.exe (Microsoft Defender) service frequently instantiates .NET components to scan files in real-time. During these scans, it registers specific TypeLib GUIDs that overlap with known security tool signatures, causing the rule to trigger on standard file access events rather than actual red/black team activity.
- Filter/Exclusion: Exclude processes where ProcessName is MsMpEng.exe and the parent process is svchost.exe. Alternatively, add a filter for TypeLib GUIDs specifically associated with Microsoft Defender’s internal scanning engine (e.g., GUID: 00000000-0000-0000-0000-000000000001 - replace with actual known Defender GUID).
Scenario: Scheduled Backup Jobs via Veeam or Commvault
- Context: Enterprise backup solutions like Veeam Backup & Replication often utilize .NET agents to manage inventory and metadata. When a scheduled job runs (e.g., nightly full backup), the agent loads specific TypeLibs for database interaction that mimic the GUID patterns of red-team reconnaissance tools, leading to high-volume false positives during maintenance windows.
- Filter/Exclusion: Create an exclusion based on ProcessName containing “Veeam” or “Commvault” and restrict detection to non-business hours (e.g., 02:00–06:00) if the backup jobs are known to run then, or explicitly whitelist the specific TypeLib GUIDs used by these backup agents.
**Scenario