Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging custom or known .NET-based red and black team tools by identifying unique TypeLibGUID signatures within process execution logs. Proactively hunting for these indicators in Azure Sentinel allows the SOC to distinguish between legitimate security tooling and potential malicious activity that mimics trusted .NET frameworks, thereby reducing blind spots in tool detection.

YARA Rule

rule HKTL_NET_GUID_SharpReg {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/jnqpblc/SharpReg"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "8ef25b00-ed6a-4464-bdec-17281a4aa52f" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/jnqpblc/SharpReg
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects .NET red/blue-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Office 365/SharePoint Provisioning Scripts

  • Context: Enterprise IT administrators frequently run PowerShell scripts using Microsoft.SharePoint.Client or Office 365 Management libraries to provision users or manage sites. These .NET assemblies often register specific TypeLibGUIDs that overlap with known red-team tool signatures (e.g., mimicking the GUID structure of tools like BloodHound or SharpUp).
  • Suggested Filter: Exclude alerts where the parent process is powershell.exe running under a service account (e.g., DOMAIN\svc-o365-provision) and the command line arguments contain keywords like -ImportModule, New-User, or Set-SPOProperty.

• Scenario: Scheduled Endpoint Protection Health Checks

  • Context: Managed Security Service Providers (MSSP) often deploy scheduled jobs using tools like Sysmon or custom .NET agents to query endpoint health. These agents may load specific .NET libraries for telemetry that share TypeLibGUIDs with black-team reconnaissance tools (e.g., PowerSploit modules).
  • Suggested Filter: Create an exclusion based on the Image path of the parent process, specifically targeting known security agent paths such as C:\Program Files\Microsoft Defender Antivirus\msseces.exe or C:\Program Files\CrowdStrike\csagent.exe, regardless of the child .NET process GUID.

• Scenario: CI/CD Pipeline Artifact Generation

  • Context: During build and deployment cycles, internal DevOps servers (e.g., Azure Dev Agents or Jenkins nodes) execute .NET compilation tasks that generate temporary TypeLibGUIDs