Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis posits that adversaries are leveraging C#-based red and black team tools within the environment, identifiable by unique TypeLib GUID signatures often associated with known security utilities. Proactively hunting for these artifacts in Azure Sentinel is critical to distinguish legitimate security operations from potential adversary tooling masquerading as benign administrative or testing software.

YARA Rule

rule HKTL_NET_GUID_BYTAGE {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/KNIF/BYTAGE"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "8e46ba56-e877-4dec-be1e-394cb1b5b9de" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

Scenario: Automated CI/CD Pipeline Build Agents
- Context: Enterprise build servers (e.g., Jenkins, Azure DevOps, or GitHub Actions runners) frequently execute .NET compilation tasks. These agents often load standard C# libraries (like System.Runtime or specific testing frameworks such as NUnit or xUnit) which generate unique TypeLibGUIDs that overlap with known security tool signatures.
- Filter/Exclusion: Create an exclusion based on the Process Name and Parent Process. Exclude events where the process name matches build agents (e.g., dotnet.exe, msbuild.exe, JenkinsAgent.exe) running under a service account (e.g., NT SERVICE\BuildService or specific CI user groups) rather than an interactive user.
Scenario: Scheduled Office 365/Teams Proactive Maintenance
- Context: Microsoft Teams and Outlook utilize C# components for background updates, policy enforcement, and add-in management. During scheduled maintenance windows (e.g., early morning), these applications load specific TypeLibGUIDs associated with their internal diagnostic or update modules, which may be flagged as “Red Team” reconnaissance tools due to similar GUID structures.
- Filter/Exclusion: Implement a time-based filter combined with an Image Path exclusion. Exclude events occurring between 02:00 and 05:00 local time where the image path contains \Microsoft Teams\ or \Office16\, specifically targeting processes like TeamsUpdate.exe or Outlook.exe.
Scenario: Enterprise Endpoint Detection and Response (EDR) Self-Scanning
- Context: The