Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that can be uniquely identified by their specific TypeLib GUID signatures within Azure Sentinel logs. Proactively searching for these artifacts allows the SOC to distinguish legitimate security tooling from malicious activity masquerading as standard development environments, thereby reducing false positives and enhancing visibility into internal reconnaissance efforts.

YARA Rule

rule HKTL_NET_GUID_AddReferenceDotRedTeam {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/ceramicskate0/AddReferenceDotRedTeam"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "73c79d7e-17d4-46c9-be5a-ecef65b924e4" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/ceramicskate0/AddReferenceDotRedTeam
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, tailored for an enterprise environment:

• Scenario: Automated Patch Deployment via SCCM or Intune

  • Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune agents execute C#-based deployment scripts to install updates. These tools often instantiate .NET assemblies that generate specific TypelibGUID signatures identical to those used by red-team reconnaissance frameworks (e.g., SharpUp or BloodHound).
  • Filter/Exclusion: Create an exclusion for the process image paths associated with known patching agents, specifically:
    • C:\Program Files\Microsoft Intune Management Extension\*
    • C:\Program Files (x86)\Microsoft Configuration Manager\bin\x64\ccmexec.exe
    • Additionally, exclude the specific parent process WmiPrvSE.exe when running under the SYSTEM account during maintenance hours.

• Scenario: Enterprise Anti-Virus Real-Time Scanning

  • Context: Modern Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or SentinelOne utilize C# components for their real-time scanning engines and heuristic analysis modules. When these agents scan large file repositories, they load .NET libraries that trigger the rule’s TypelibGUID detection logic, mimicking the behavior of a black-team lateral movement tool.
  • Filter/Exclusion: Filter out alerts where the parent process is a known security vendor executable. Specific exclusions should target:
    • Process Name: C:\Program Files\CrowdStrike\fs.exe or SentinelOne\SentinelAgent.exe.
    • User Context: Exclude events originating from the NT AUTHORITY\SYSTEM account running