Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for specific TypeLibGUID values associated with known C# offensive and defensive security tools within Azure Sentinel. Proactively hunting for these artifacts is essential to distinguish legitimate security operations from malicious tool deployment that may indicate early-stage reconnaissance or post-exploitation activities.

YARA Rule

rule HKTL_NET_GUID_Change_Lockscreen {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/nccgroup/Change-Lockscreen"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "78642ab3-eaa6-4e9c-a934-e7b0638bc1cc" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/nccgroup/Change-Lockscreen
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Automated Patch Deployment via SCCM or Intune

  • Scenario: Enterprise endpoint management systems (like Microsoft Endpoint Configuration Manager or Intune) frequently utilize C#-based agents to push updates. These agents often load specific .NET libraries containing TypelibGUID values that match known Red Team tool signatures during the installation of security patches or software deployments.
  • Filter/Exclusion: Exclude processes originating from trusted management paths (e.g., C:\Program Files\Microsoft Configuration Manager\) and filter by parent process names such as ccmexec.exe, IntuneManagementExtension.exe, or TaskScheduler when the execution time aligns with scheduled maintenance windows.

• CI/CD Pipeline Build Agents

  • Scenario: In environments running Azure DevOps, Jenkins, or GitHub Actions self-hosted runners, build agents execute C# compilation tasks and unit tests. These agents often load standard .NET development libraries that share GUIDs with Red Team reconnaissance tools (e.g., SharpUp or PowerSploit) while processing code repositories or generating build artifacts.
  • Filter/Exclusion: Create an exclusion for processes running under specific service accounts used by CI/CD pipelines (e.g., svc-build-agent, jenkins-user) and restrict the scope to known build server IP addresses or hostnames ending in -build or -runner.

• Scheduled Inventory Scans with Lansweeper or PDQ

  • Scenario: IT asset management tools like Lansweeper or PDQ Deploy utilize C# components to perform deep system inventory scans. During these scheduled jobs, they load .NET assemblies that query the registry and file system, triggering alerts on `TypelibGUID