Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects the execution of specialized .NET-based red and black team tools by identifying unique type library GUIDs (typelibguid) often associated with security testing utilities. A SOC team should proactively hunt for these artifacts in Azure Sentinel to distinguish legitimate security assessments from potential adversary activity that mimics similar tooling patterns, thereby reducing false positives during incident response.

YARA Rule

rule HKTL_NET_GUID_SharpChisel {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/shantanu561993/SharpChisel"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "f5f21e2d-eb7e-4146-a7e1-371fd08d6762" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/shantanu561993/SharpChisel
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/red-black-team tools via typelibguid,” along with suggested filters and exclusions:

• Scenario: Automated Office 365 ProPlus Updates

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) frequently initializes .NET assemblies during background update cycles. These processes often instantiate specific TypeLibGUIDs associated with Office automation libraries, which can mimic the signature of red-team tools like SharpUp or PowerSploit.
  • Suggested Filter: Exclude events where the parent process is OfficeClickToRun.exe (or oobebroker.exe) and the file path contains \Microsoft Office\root\office16\.

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) utilize .NET-based scanning engines. During scheduled deep scans or definition updates, the agent’s service process may load TypeLibGUIDs that overlap with black-team tools like SharpHunt or BloodHound.
  • Suggested Filter: Create an exclusion for processes running under the context of known EDR services (e.g., C:\Program Files\CrowdStrike\fsqa.exe or C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe) when the event timestamp aligns with defined maintenance windows.

• Scenario: PowerShell Script Execution by Admin Accounts

  • Context: System administrators often run custom .NET-based automation scripts (using System.Management.Automation or similar) to manage Active Directory, inventory hardware, or configure Group Policy. These legitimate administrative tasks generate TypeLibGUIDs identical to those used by tools like PowerShell Empire or Cobalt Strike Beacon.