Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through their unique typelib GUID signatures within Azure Sentinel logs. Proactively hunting for these specific tool identifiers allows the SOC team to distinguish between legitimate security operations and suspicious reconnaissance or post-exploitation activities that may otherwise blend into normal background noise.

YARA Rule

rule HKTL_NET_GUID_CVE_2019_1253 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/padovah4ck/CVE-2019-1253"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "584964c1-f983-498d-8370-23e27fdd0399" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including recommended filters and exclusions:

Scenario: Automated Deployment Pipelines (Azure DevOps / GitHub Actions)
- Context: CI/CD agents frequently execute .NET-based build tasks or deployment scripts that instantiate standard C# libraries. These processes often load specific TypeLib GUIDs associated with Red Team tools (e.g., SharpUp, BloodHound) during the compilation or testing phase, even when no actual security assessment is occurring.
- Filter/Exclusion: Create an exclusion for process paths matching known CI/CD service accounts or agent binaries (e.g., C:\Program Files\Microsoft Visual Studio\*\MSBuild\*, C:\Azure\DevOpsAgent\*\Runner.exe) and restrict the alert to non-build server environments.
Scenario: Scheduled Endpoint Protection Scans
- Context: Enterprise EDR agents (such as CrowdStrike Falcon or Microsoft Defender for Endpoint) often include a “Red Team Simulation” module that runs on a daily schedule. This module loads C# assemblies to scan for specific threat indicators, triggering the rule every morning at 02:00 AM across all endpoints regardless of active penetration testing.
- Filter/Exclusion: Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 01:00–04:00 local time) or exclude processes running under the specific EDR service account (e.g., NT SERVICE\DefenderSvc or CrowdStrike Falcon Service).
Scenario: Internal Development Environments and IDEs
- Context: Developers in R&D departments using Visual Studio or JetBrains Rider often utilize C# extensions that mimic Red Team tool signatures. When compiling large solutions or