Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies the execution of specialized C# Red and Black team tools by analyzing unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these artifacts allows the SOC team to distinguish between legitimate security testing activities and potential adversary use of similar frameworks for stealthy reconnaissance or lateral movement.

YARA Rule

rule HKTL_NET_GUID_ADFSDump {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/fireeye/ADFSDump"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "9ee27d63-6ac9-4037-860b-44e91bae7f0d" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/fireeye/ADFSDump
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid”, along with suggested filters or exclusions:

• Scenario: Automated Build and Deployment Pipelines

  • Context: CI/CD agents (e.g., Jenkins, Azure DevOps, GitHub Actions) running on build servers frequently execute C# compilation tasks. These processes often instantiate the .NET runtime to generate temporary type libraries during the build phase, triggering the typelibguid detection logic even though no security tool is being actively used for testing.
  • Filter/Exclusion: Exclude process paths containing standard CI/CD executable names (e.g., dotnet.exe, msbuild.exe, vstest.console.exe) running under service accounts like SYSTEM or specific build service identities (svc-build-agent).

• Scenario: Enterprise Endpoint Management Software

  • Context: Legacy or modern endpoint management suites (such as Microsoft SCCM, Ivanti, or ManageEngine) utilize C# agents to inventory hardware and software. These agents periodically scan the registry for TypeLib GUIDs to update asset inventories, mimicking the behavior of Red/Black team reconnaissance tools.
  • Filter/Exclusion: Create a whitelist exclusion for known enterprise management process names (e.g., ccmexec.exe, IvantiAgent.exe) and restrict detection to non-service user contexts if the tool is typically run as a system service.

• Scenario: Scheduled PowerShell Inventory Scripts

  • Context: Administrators often schedule nightly PowerShell scripts that utilize C# classes (via Add-Type or compiled assemblies) to query Active Directory or local machine configurations. These scripts explicitly read TypeLib GUIDs from the registry to map application versions, triggering the rule during scheduled maintenance windows.
  • Filter/Exclusion: Exclude events where the