Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these specific tool identifiers is essential to distinguish legitimate security operations from malicious reconnaissance or lateral movement attempts that may otherwise blend into routine background noise.

YARA Rule

rule HKTL_NET_GUID_DecryptAutoLogon {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/securesean/DecryptAutoLogon"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "015a37fc-53d0-499b-bffe-ab88c5086040" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/securesean/DecryptAutoLogon
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID,” including suggested filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: CI/CD agents (e.g., Azure DevOps, Jenkins) running on build servers frequently execute .NET-based compilation tasks or unit tests that instantiate C# assemblies with specific TypelibGUIDs similar to security tools.
  • Filter/Exclusion: Exclude the Service Principal accounts used by the CI/CD platform (e.g., AZURE-DEVOPS-BUILD-SVC) and filter for process paths containing \bin\Microsoft.Build.Tasks.Core.dll or specific build agent hostnames.

• Scenario: Microsoft Defender for Endpoint Management

  • Context: The native Microsoft Defender for Endpoint service (MsMpEng.exe or SenseClientService.exe) often loads C# components during policy updates, threat scanning, or real-time protection checks that match the rule’s signature GUIDs.
  • Filter/Exclusion: Create an exclusion based on the process image path C:\Program Files\Microsoft Defender Antivirus\* and exclude events where the parent process is MsMpEng.exe.

• Scenario: Scheduled Office 365 ProPlus Updates

  • Context: The Microsoft Office Click-to-Run service runs scheduled jobs to update Office applications, utilizing C# libraries that generate TypelibGUIDs often flagged by this rule as Red/Black team tool activity.
  • Filter/Exclusion: Filter out events where the process name is OfficeClickToRun.exe or O365C2RClient.exe, specifically during standard maintenance windows (e.g., 01:00–04:00 local time).

• **Scenario: Enterprise