Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel. Proactively hunting for these indicators allows the SOC to distinguish between legitimate security testing operations and malicious tool usage that may mimic standard administrative behavior.

YARA Rule

rule HKTL_NET_GUID_BadPotato {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/BeichenDream/BadPotato"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "0527a14f-1591-4d94-943e-d6d784a50549" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/BeichenDream/BadPotato
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Jenkins or Azure DevOps) running C#-based unit tests or code analysis tools like SonarQube or OpenCover on build servers. These tools often instantiate COM objects to generate coverage reports, triggering the typelibguid signature associated with red-team instrumentation libraries.
  • Filter/Exclusion: Exclude processes running under specific service accounts (e.g., NT SERVICE\Jenkins, BUILD-AGENT) or restrict detection to exclude known build server hostnames and IP ranges where these pipelines execute nightly.

• Scenario: Enterprise Endpoint Management & Patching

  • Context: Scheduled maintenance jobs using Microsoft SCCM (ConfigMgr) or Jamf Pro agents performing software inventory scans. These agents utilize C# components to query system registries and COM interfaces, which can mimic the GUID patterns of security testing tools like BloodHound or SharpUp.
  • Filter/Exclusion: Create a whitelist for known management agent processes (e.g., ccmexec.exe, jamf.exe) and filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where these scans are scheduled.

• Scenario: Internal Development & QA Environments

  • Context: Developers running local testing suites or automated regression tests in a Dev/Test environment using frameworks like xUnit or NUnit. These tools often load C# assemblies that register specific TypeLib GUIDs similar to those used by black-team reconnaissance tools (e.g., Ladon or PowerSploit