Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection rule identifies the execution of C#-based Red and Blue team tools by analyzing unique TypeLibGUID signatures within process events. Proactive hunting for these indicators in Azure Sentinel is essential to distinguish legitimate security testing activities from potential adversary reconnaissance that mimics standard tooling behavior.

YARA Rule

rule HKTL_NET_GUID_DarkFender {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xyg3n/DarkFender"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "12fdf7ce-4a7c-41b6-9b32-766ddd299beb" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/0xyg3n/DarkFender
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated CI/CD Build Pipeline Execution

  • Context: Enterprise build servers (e.g., Azure DevOps Agents or Jenkins) frequently compile .NET solutions using msbuild.exe or dotnet.exe. These tools often load specific C# assemblies containing unique TypeLibGUIDs to manage project references, which can mimic the signature of Red/Black team reconnaissance tools.
  • Suggested Filter: Exclude processes running under the context of known build service accounts (e.g., NT SERVICE\BuildAgent or SYSTEM) where the parent process is a recognized CI/CD orchestrator (VSTest.exe, Jenkins.exe).

• Scenario: Scheduled Office 365 ProPlus Update Tasks

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) or scheduled update jobs often load C# components to validate installation integrity. These components utilize TypeLibGUIDs that overlap with security tool signatures, particularly during off-hours maintenance windows.
  • Suggested Exclusion: Create a whitelist for the specific TypeLibGUID associated with Microsoft Office Click-to-Run updates (e.g., {91493401-5594-11D1-A825-B00C047802B6}) when executed by the user account NT AUTHORITY\SYSTEM.

• Scenario: Internal IT Asset Management Scans

  • Context: Enterprise asset management solutions (such as SCCM/MECM or Lansweeper agents) perform periodic inventory scans of installed software. These agents often invoke C# scripts to enumerate registry keys and COM objects, triggering the detection logic due to