Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for unique TypeLibGUID signatures associated with known .NET-based red and black team reconnaissance or post-exploitation tools. Proactive hunting for these indicators in Azure Sentinel is essential to uncover stealthy tool usage that may evade standard signature-based defenses, allowing the SOC team to validate legitimate administrative actions against suspicious tool deployment early in the kill chain.

YARA Rule

rule HKTL_NET_GUID_SharpSvc {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/jnqpblc/SharpSvc"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "52856b03-5acd-45e0-828e-13ccb16942d1" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/jnqpblc/SharpSvc
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ”.NET Red/Black-team tools via typelibguid” detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Agents with .NET Components

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize .NET-based agents that load specific TypeLib GUIDs during scheduled backup windows to manage data snapshots. These tools may mimic the behavior of red-team reconnaissance tools by querying system registries and accessing file metadata, triggering the rule.
  • Suggested Filter/Exclusion: Create a whitelist exclusion based on the ImageName (e.g., Veeam.Backup.Service.exe) or the specific CommandLine containing backup keywords (e.g., -mode=backup). Alternatively, exclude the known TypeLib GUIDs associated with these vendors from the detection logic.

• Scenario: Endpoint Detection and Response (EDR) Self-Scans

  • Context: Security platforms such as CrowdStrike Falcon, Carbon Black, or Trend Micro Apex One perform continuous self-scanning and telemetry collection using .NET assemblies. Their internal engines often instantiate TypeLib GUIDs to monitor process creation and file integrity, which can be misidentified as an external red-team tool attempting to enumerate the environment.
  • Suggested Filter/Exclusion: Implement a filter that excludes events where the ParentImageName matches known EDR service executables (e.g., FalconSensorService.exe, cbcservice.exe). Additionally, exclude TypeLib GUIDs belonging to the specific security vendor’s namespace.

• Scenario: Scheduled PowerShell Administrative Tasks

  • Context: IT Operations teams frequently schedule nightly maintenance scripts using PowerShell or Azure Automation Runbooks. These scripts often invoke .NET libraries (e.g