Detects .NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting the presence of known .NET-based red and blue team tools through their unique typelibGUID signatures within Azure Sentinel. Proactive hunting for these indicators is essential to distinguish legitimate security tooling from malicious .NET processes that may mimic similar GUIDs, thereby reducing false positives and uncovering stealthy threat actor behaviors in the environment.

YARA Rule

rule HKTL_NET_GUID_SuperSQLInjectionV1 {
    meta:
        description = "Detects .NET red/black-team tools via typelibguid"
        reference = "https://github.com/shack2/SuperSQLInjectionV1"
        author = "Arnim Rupp"
        date = "2021-01-21"
    strings:
        $typelibguid0 = "d5688068-fc89-467d-913f-037a785caca7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/shack2/SuperSQLInjectionV1
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects .NET red/red-black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Context: The SCCM client (ccmexec.exe) frequently loads .NET assemblies to process software updates or inventory scans. These processes often instantiate specific typelibguid values associated with the SCCM agent framework, which can mimic Red Team tool signatures.
  • Filter/Exclusion: Exclude processes where the parent image is C:\Program Files (x86)\Microsoft Configuration Manager\ccmexec.exe or filter by the specific typelibguid range known to be used by SCCM components (e.g., GUID-SCCM-Inventory).

• Scenario: Scheduled PowerShell Compliance Audits

  • Context: Enterprise security teams often run scheduled tasks using PowerShell scripts (powershell.exe) that utilize .NET libraries for compliance reporting. These scripts may load standard .NET type libraries that overlap with the GUIDs used by tools like BloodHound or SharpUp.
  • Filter/Exclusion: Create an exclusion based on the command line argument containing specific keywords (e.g., *ComplianceAudit.ps1 or *MonthlyReport) and restrict detection to processes not spawned by Task Scheduler (svchost.exe with service name Schedule).

• Scenario: Visual Studio Build Agents in CI/CD Pipelines

  • Context: Internal DevOps pipelines often utilize Microsoft Build Agents (e.g., Azure DevOps or TFS agents) running on .NET frameworks. During compilation and testing phases, these agents load various type libraries that match the detection logic for Red Team tools like SharpUp or PowerSploit.
  • **Filter/Exclusion