Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging custom or known .NET-based offensive and defensive tools that register unique TypeLib GUIDs within the Windows environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify stealthy tool deployment often missed by standard signature-based detections, thereby uncovering potential red-team exercises or early-stage attacker reconnaissance activities.

YARA Rule

rule HKTL_NET_GUID_SharpHandler {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/jfmaes/SharpHandler"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "46e39aed-0cff-47c6-8a63-6826f147d7bd" ascii nocase wide
        $typelibguid1 = "11dc83c6-8186-4887-b228-9dc4fd281a23" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/jfmaes/SharpHandler
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects .NET red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Automated Backup or Patching Agents

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or patch management systems (e.g., SCCM/MECM, Ivanti) often utilize .NET assemblies to interact with the OS. These tools frequently instantiate COM objects that generate specific typelibguid values matching those used by security assessment frameworks like Sysinternals or custom red-team agents.
  • Filter/Exclusion: Create an exclusion based on the Process Image Path and Parent Process. Exclude events where the parent process is a known service executable (e.g., C:\Program Files\Microsoft System Center Configuration Manager\Components\SMS_EXEC.exe) or specific backup services (Veeam.Backup.Service.exe).

• Scenario: Office 365/OneDrive Synchronization

  • Context: The Microsoft OneDrive sync client and Office Click-to-Run installer are heavy .NET applications. During startup, file indexing, or large file uploads, they load various COM libraries that produce typelibguid signatures indistinguishable from red-team tools like BloodHound or SharpUp.
  • Filter/Exclusion: Filter out events where the Process Name matches known Office synchronization binaries (e.g., OneDrive.exe, Groove.exe, OfficeClickToRun.exe). Additionally, exclude if the User Account is a standard domain user account running these specific processes during business hours.

• Scenario: Scheduled PowerShell Health Checks

  • Context: IT operations teams often deploy scheduled tasks that run .NET-based PowerShell scripts to monitor server health or inventory software. These scripts may invoke tools like PowerShellGet or