Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt identifies adversary activity involving C#-based red and black team tools by analyzing unique TypeLibGUID artifacts often associated with legitimate security utilities or advanced persistent threats. Proactively hunting for these signatures in Azure Sentinel is critical to distinguish between authorized internal tooling and potential lateral movement or reconnaissance efforts that may otherwise blend into normal background noise due to their low severity classification.

YARA Rule

rule HKTL_NET_GUID_DeviceGuardBypasses {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/tyranid/DeviceGuardBypasses"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "f318466d-d310-49ad-a967-67efbba29898" ascii nocase wide
        $typelibguid1 = "3705800f-1424-465b-937d-586e3a622a4f" ascii nocase wide
        $typelibguid2 = "256607c2-4126-4272-a2fa-a1ffc0a734f0" ascii nocase wide
        $typelibguid3 = "4e6ceea1-f266-401c-b832-f91432d46f42" ascii nocase wide
        $typelibguid4 = "1e6e9b03-dd5f-4047-b386-af7a7904f884" ascii nocase wide
        $typelibguid5 = "d85e3601-0421-4efa-a479-f3370c0498fd" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• https://github.com/tyranid/DeviceGuardBypasses
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Patch Management Scans (e.g., SCCM or Intune)

  • Context: Enterprise Configuration Management tools like Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune frequently utilize C#-based agents to scan system inventory. These agents often load specific .NET assemblies that generate typelibguid entries identical to those used by red-team reconnaissance tools during their discovery phases.
  • Filter/Exclusion: Create an exclusion for the known process names of the management agents (e.g., ccmexec.exe, IntuneManagementExtension.exe) and restrict the alert scope to exclude processes running under the SYSTEM or NT AUTHORITY\Network Service accounts when originating from the “Patch Management” OU.

• Scenario: Scheduled Compliance Auditing Scripts

  • Context: Security teams often deploy scheduled PowerShell scripts that invoke C# binaries (such as custom compliance checkers or third-party tools like Qualys Cloud Agent) to verify registry keys and file permissions. These legitimate background jobs trigger the same typelibguid registration events as adversarial tooling designed for lateral movement.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00–04:00 UTC) and add an exclusion based on the specific CommandLine arguments containing keywords like /compliance, /audit, or -scheduledTask.

• Scenario: Development Build Pipelines (CI/CD Agents)

  • Context: In environments where build servers (e.g., Jenkins, Azure DevOps) run directly on corporate workstations or VMs, the compilation of C# applications generates temporary `typ