Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting the usage of specific TypeLibGUIDs associated with common .NET-based red and blue team tools within the Azure Sentinel environment. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate security operations and malicious tool execution that may be leveraging similar .NET frameworks to evade traditional detection methods.

YARA Rule

rule HKTL_NET_GUID_SharpScribbles {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/V1V1/SharpScribbles"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "aa61a166-31ef-429d-a971-ca654cd18c3b" ascii nocase wide
        $typelibguid1 = "0dc1b824-c6e7-4881-8788-35aecb34d227" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/V1V1/SharpScribbles
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects .NET red/black-team tools via typelibguid rule, including suggested filters and exclusions:

• Scenario: Microsoft Defender Antivirus Scheduled Scans

  • Context: The MsMpEng.exe process (Microsoft Defender) frequently loads .NET assemblies during its scheduled daily or on-demand scans. These assemblies often contain specific TypeLibGUIDs that overlap with known red-team tool signatures, triggering the rule when no attack is occurring.
  • Suggested Filter/Exclusion: Create an exclusion based on the parent process name MsMpEng.exe and the command line containing keywords like “Scheduled Scan” or “Quick Scan.” Alternatively, exclude TypeLibGUIDs specifically associated with Microsoft Defender’s core scanning engine (e.g., 8C73F0E1-...).

• Scenario: Visual Studio Build & Deployment Pipelines

  • Context: In development environments, CI/CD agents (such as Azure DevOps Agents or Jenkins) running msbuild.exe or devenv.exe compile .NET applications. These tools instantiate various .NET components with TypeLibGUIDs that mimic red-team reconnaissance tools during the build and deployment phases.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is VSTTTaskAgent.exe, msbuild.exe, or devenv.exe. Additionally, filter by user context to exclude service accounts used for CI/CD (e.g., NT SERVICE\BuildAgent or specific Azure DevOps service principals).

• Scenario: Office 365/ProPlus Background Updates

  • Context: The Office Click-to-Run Service (OfficeClickToRun.exe) and the Office Update Orchestrator (oobroker.exe) utilize .NET components to manage feature updates and license synchronization.