Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting the execution of specialized .NET-based red and black team reconnaissance or attack simulation tools through their unique typelib GUID signatures. The SOC team should proactively hunt for these indicators in Azure Sentinel to distinguish legitimate security testing from malicious tool usage that may mimic standard administrative processes, thereby reducing false positives and uncovering stealthy threat actor movements.

YARA Rule

rule HKTL_NET_GUID_SharpByeBear {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/S3cur3Th1sSh1t/SharpByeBear"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "a6b84e35-2112-4df2-a31b-50fde4458c5e" ascii nocase wide
        $typelibguid1 = "3e82f538-6336-4fff-aeec-e774676205da" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/S3cur3Th1sSh1t/SharpByeBear
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/black-team tools via typelibguid”, including suggested filters or exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Continuous Integration servers (e.g., Jenkins, Azure DevOps) frequently utilize .NET-based build agents to compile code and run unit tests. These agents often load specific COM libraries with unique typelibguid values that match the signature of security tools like ProcMon or Fiddler.
  • Suggested Filter: Exclude processes running under the service account context (e.g., NT SERVICE\Jenkins) and restrict detection to non-build server subnets. Alternatively, add a whitelist for known build agent process names (e.g., msbuild.exe, vstest.console.exe).

• Scenario: Scheduled Office 365 Compliance & Backup Jobs

  • Context: Enterprise backup solutions (such as Veeam or Microsoft Defender for Endpoint) and compliance scanners often run scheduled .NET tasks that interact with the Office suite. These tools frequently instantiate COM objects to read registry keys or file streams, generating typelibguid signatures identical to those used by red-team reconnaissance tools.
  • Suggested Filter: Create an exclusion based on specific parent process names (e.g., VeeamTransportSvc.exe, OfficeScanTask.exe) and time-based filtering to ignore events occurring during known maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: End-User Development Environments

  • Context: In organizations with internal developer teams, engineers running Visual Studio or .NET Core applications locally may trigger the rule. When developers debug applications using tools like dotnet-trace or PerfView, these utilities generate `typelibguid