Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting the presence of known Red and Black team .NET tools through their unique typelib GUID signatures within Azure Sentinel. Proactively hunting for these specific tool artifacts allows the SOC team to distinguish between authorized security testing operations and unauthorized reconnaissance or lateral movement attempts that may mimic legitimate administrative traffic.

YARA Rule

rule HKTL_NET_GUID_SharpHide {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/outflanknl/SharpHide"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "443d8cbf-899c-4c22-b4f6-b7ac202d4e37" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/outflanknl/SharpHide
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/black-team tools via typelibguid,” along with suggested filters or exclusions:

• Scenario: Automated Backup and Archiving Tasks

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize .NET-based agents that load specific COM libraries to manage snapshot creation, file indexing, or deduplication. These processes frequently instantiate typelib GUIDs that overlap with security tool signatures during scheduled nightly jobs.
  • Suggested Filter: Exclude the process name Veeam.Backup.Service.exe (or similar agent executables) when running under the service account NT SERVICE\VeeamBackupService, or filter out events occurring within the defined maintenance window (e.g., 02:00–04:00 local time).

• Scenario: Microsoft Endpoint Configuration Manager (SCCM/MECM)

  • Context: During software deployment, patching cycles, or inventory scans, the SCCM client (ccmsetup.exe or ccmexec.exe) invokes .NET assemblies to communicate with the site server. These interactions often trigger typelib GUIDs associated with configuration management that mimic Red/Black team tool behavior.
  • Suggested Filter: Create an exclusion for process paths containing \Microsoft Configuration Manager\ and filter out events where the parent process is ccmexec.exe or WUAHandler.exe.

• Scenario: Office 365 ProPlus Update and Telemetry

  • Context: The Microsoft Office suite (specifically Office Click-to-Run Service) runs background .NET processes to handle updates, license validation, and telemetry. These services frequently load typelib GUIDs related to document processing and cloud synchronization that can be misidentified as security tooling.