Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection rule identifies the execution of specialized C# Red and Black team security tools by monitoring unique TypeLibGUID signatures within process creation events. Proactively hunting for these specific tool identifiers in Azure Sentinel enables the SOC to distinguish between authorized security operations and potential adversary activity that mimics legitimate tool usage, thereby reducing false positives and uncovering stealthy reconnaissance efforts.

YARA Rule

rule HKTL_NET_GUID_CVE_2020_1337 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/neofito/CVE-2020-1337"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "d9c2e3c1-e9cc-42b0-a67c-b6e1a4f962cc" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/neofito/CVE-2020-1337
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Jenkins, Azure DevOps, or GitHub Actions runners) frequently compile .NET applications or execute unit tests using C# tools like dotnet, NUnit, or xUnit within the build environment. These processes often load specific TypeLibGUIDs associated with testing frameworks that mimic Red/Black team tool signatures.
  • Filter/Exclusion: Exclude process names matching known CI/CD agents (e.g., Jenkins.exe, VSTS.Agent.exe) and restrict detection to non-build server subnets or exclude the specific TypeLibGUIDs associated with standard testing frameworks like NUnit.Framework when running on build nodes.

• Scenario: Enterprise Endpoint Management & Patching

  • Context: System administrators utilize C#-based management suites such as Microsoft SCCM (Configuration Manager), Ivanti, or Jamf to deploy patches and inventory hardware. These agents often invoke C# components for software deployment tasks, triggering the detection logic due to shared TypeLibGUIDs used by security scanning modules within these suites.
  • Filter/Exclusion: Create an exclusion rule for processes running under the SYSTEM or specific service accounts (e.g., NT SERVICE\ccmexec) and whitelist known management tool executables like ccmsetup.exe, ivanti_agent.exe, or jamf.exe.

• Scenario: Scheduled Database Maintenance Jobs

  • Context: IT operations teams schedule nightly SQL Server maintenance tasks using C#-based automation scripts (e.g., via PowerShell wrapping .NET assemblies). Tools like Redgate SQL Compare or