Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies adversary activity by detecting the presence of known .NET-based Red and Black team security tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate internal security operations and potential adversarial use of similar tooling, thereby reducing false positives and uncovering stealthy reconnaissance or post-compromise activities.

YARA Rule

rule HKTL_NET_GUID_SharpCrashEventLog {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/slyd0g/SharpCrashEventLog"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "98cb495f-4d47-4722-b08f-cefab2282b18" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/slyd0g/SharpCrashEventLog
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: Enterprise Configuration Management (SCCM) or Microsoft Intune agents frequently utilize .NET assemblies to deploy updates and run scripts. These processes often instantiate specific typelibguid values associated with the underlying deployment engine, which can mimic Red Team tool signatures (e.g., Mimikatz or SharpUp).
  • Filter/Exclusion: Exclude process paths containing C:\Program Files\Microsoft Configuration Manager\ and C:\Windows\System32\ccmsetup.exe. Additionally, filter out events where the parent process is ccmexec.exe or IntuneManagementExtension.exe.

• Scenario: Scheduled Backup Jobs Using .NET Framework

  • Context: Legacy backup solutions (e.g., Veeam, Commvault) often run scheduled tasks that invoke .NET executables to manage storage snapshots. These tools may load specific type libraries during initialization that match the typelibguid of common Blue/Red team utilities like SharpHunt or PowerSploit components.
  • Filter/Exclusion: Create an exclusion for process names matching Veeam.Backup.Service.exe, Commvault.cmd, and any process running under the user account NT SERVICE\VSS. Filter based on the specific scheduled task name containing “Backup” or “Snapshot”.

• Scenario: Internal DevOps CI/CD Pipeline Execution

  • Context: Build agents (e.g., Azure DevOps, Jenkins) often execute .NET-based build steps that load standard libraries. During compilation or artifact signing phases, these agents may trigger the detection logic due to shared type library GUIDs used by tools like `dot