Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies adversarial activity by monitoring for specific typelibguid values associated with known .NET-based red and blue team reconnaissance or exploitation tools within the Azure Sentinel environment. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate security testing operations and potential adversary tooling that mimics standard administrative behavior, thereby reducing false positives while uncovering stealthy lateral movement attempts.

YARA Rule

rule HKTL_NET_GUID_SharPermission {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/mitchmoser/SharPermission"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "84d2b661-3267-49c8-9f51-8f72f21aea47" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects .NET red/blue-team tools via typelibguid” rule, including suggested filters and exclusions:

Scenario: Microsoft Defender for Endpoint (MDE) Self-Scanning
- Context: The MDE sensor (MsMpEng.exe or SenseBrokerLauncher.exe) periodically loads .NET assemblies to scan its own telemetry components. This often triggers the rule because the sensor uses specific TypeLibGUIDs associated with Microsoft’s internal security stack, which mimic red-team tool signatures.
- Filter/Exclusion: Exclude processes where the parent process is MsMpEng.exe or SenseBrokerLauncher.exe, and filter out events where the image path contains \Program Files\Microsoft Defender Antivirus\.
Scenario: Scheduled PowerShell Health Checks
- Context: IT operations teams often run scheduled tasks (via Task Scheduler) that execute PowerShell scripts to monitor server health. These scripts frequently load .NET libraries (e.g., System.Management.Automation) which generate TypeLibGUIDs indistinguishable from penetration testing tools like BloodHound or SharpUp.
- Filter/Exclusion: Create a filter for processes where the command line contains -Command or .ps1 extensions, and exclude events originating from known service accounts (e.g., NT SERVICE\TaskScheduler) running on standard maintenance windows (e.g., 02:00–04:00).
Scenario: Azure AD Connect Synchronization
- Context: The Microsoft Azure AD Connect sync engine (MiisClient.exe or SyncEngineService.exe) utilizes .NET components to map on-premise directories to the cloud. During synchronization cycles, it instantiates specific TypeLibGUIDs that overlap with those used by common black-team reconnaissance tools like PowerSploit.
- **Filter