Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary execution of C#-based offensive and defensive tools by monitoring unique TypeLibGUID artifacts often left behind during tool deployment or reconnaissance activities. Proactively hunting for these signatures in Azure Sentinel is critical to distinguish legitimate administrative automation from potential red-team exercises or stealthy initial access attempts that may otherwise blend into standard background noise.

YARA Rule

rule HKTL_NET_GUID_BackNet {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/valsov/BackNet"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "9fdae122-cd1e-467d-a6fa-a98c26e76348" ascii nocase wide
        $typelibguid1 = "243c279e-33a6-46a1-beab-2864cc7a499f" ascii nocase wide
        $typelibguid2 = "a7301384-7354-47fd-a4c5-65b74e0bbb46" ascii nocase wide
        $typelibguid3 = "982dc5b6-1123-428a-83dd-d212490c859f" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://github.com/valsov/BackNet
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, along with suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM or Intune

  • Context: Enterprise deployment engines (like Microsoft Endpoint Configuration Manager or Intune) frequently utilize C# scripts to install patches or applications. These scripts often load specific .NET assemblies that contain unique TypelibGUID values identical to those used by security testing frameworks, triggering the rule during routine maintenance windows.
  • Suggested Filter/Exclusion: Create an exclusion based on the Parent Process Name (ccmexec.exe, Microsoft.IntuneManagementAgent.exe) and restrict the alert time window to standard business hours or scheduled maintenance periods (e.g., 02:00–06:00 UTC).

• Scenario: Internal CI/CD Pipeline Build Agents

  • Context: In a DevOps environment, build agents (such as Azure DevOps Agents, Jenkins, or GitHub Actions runners) execute C# compilation tasks and unit tests. These agents often instantiate Red Team tooling libraries to validate code security compliance before deployment, generating the specific TypelibGUID signatures associated with penetration testing tools.
  • Suggested Filter/Exclusion: Exclude alerts originating from known Build Agent Hostnames (e.g., build-agent-01, jenkins-slave-*) or filter by the User Account running the build service (e.g., NT AUTHORITY\SYSTEM or a dedicated svc-buildagent account).

• Scenario: Scheduled Enterprise Backup and Inventory Scripts

  • Context: Many organizations use custom C# PowerShell scripts for inventory management, asset tagging, or backup verification. These scheduled jobs may load the same underlying .NET libraries used by Red Team tool