Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypelibGUID signatures within Azure Sentinel. Proactive hunting for these specific tool identifiers is essential to distinguish legitimate security operations from malicious reconnaissance or lateral movement attempts that leverage similar custom C# utilities.

YARA Rule

rule HKTL_NET_GUID_CVE_2020_0668 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/RedCursorSecurityConsulting/CVE-2020-0668"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "1b4c5ec1-2845-40fd-a173-62c450f12ea5" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, along with suggested filters and exclusions:

Scenario: Automated CI/CD Pipeline Execution
- Context: Continuous Integration servers (e.g., Jenkins, Azure DevOps) frequently compile C# projects or run unit tests using the .NET SDK. These processes often load specific TypeLibGUIDs associated with build tools like Microsoft.Build.Tasks.Core or test runners like NUnit and xUnit, which mimic the signature of Red/Black team reconnaissance tools.
- Filter/Exclusion: Exclude processes running under service accounts (e.g., AZURE-DEVOPS-BUILD-SVC) located within dedicated build server subnets, specifically filtering for executable paths containing \nuget\ or \packages\.
Scenario: Scheduled Office 365 ProPlus Updates
- Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) performs background updates and feature installations using C# components that register TypeLibGUIDs similar to security monitoring agents. This often triggers during off-hours maintenance windows, appearing as a new tool deployment.
- Filter/Exclusion: Create an exclusion for the process name OfficeClickToRun.exe when the parent process is msiexec.exe or taskhostw.exe, and restrict the alert to only fire if the execution path is outside of C:\Program Files\Microsoft Office.
Scenario: Enterprise Endpoint Management (SCCM/Intune) Deployments
- Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents push software updates and inventory scans. These C#-based agents utilize TypeLibGUIDs for hardware inventory collection that overlap with the GUIDs used by Red Team asset discovery tools like `Sharp