Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based Red and Black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these indicators is essential to distinguish legitimate security tooling from malicious C# processes that may mimic known good applications to evade detection.

YARA Rule

rule HKTL_NET_GUID_DInvisibleRegistry {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NVISO-BE/DInvisibleRegistry"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "31d576fb-9fb9-455e-ab02-c78981634c65" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/NVISO-BE/DInvisibleRegistry
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID,” including suggested filters and exclusions:

• Scheduled .NET Application Deployment & Updates

  • Scenario: Enterprise deployment tools like Microsoft System Center Configuration Manager (SCCM) or Chocolatey frequently execute C# scripts to install, update, or patch applications. These processes often load standard .NET assemblies containing specific TypelibGUIDs that match the rule’s signature for red-team reconnaissance tools.
  • Filter/Exclusion: Exclude process paths matching known deployment executables (e.g., C:\Windows\CCM\CcmExec.exe, C:\ProgramData\chocolatey\bin\choco.exe) and restrict detection to non-business hours if the deployment is strictly scheduled for off-hours.

• Automated PowerShell Reporting & Compliance Jobs

  • Scenario: Internal compliance teams often run nightly PowerShell scripts (wrapped in C#) that query Active Directory or generate audit reports using libraries like System.Management.Automation. These scripts utilize common .NET type libraries that trigger the rule, mimicking the behavior of black-team enumeration tools.
  • Filter/Exclusion: Filter out processes where the parent process is powershell.exe running under a specific service account (e.g., DOMAIN\svc-compliance) and exclude known internal script paths located in C:\Scripts\Compliance\.

• Microsoft Office 365 & OneDrive Sync Operations

  • Scenario: The OneDrive for Business sync client and Office Click-to-Run update services utilize C# components to manage file synchronization and license verification. These background processes load type libraries that share GUIDs with popular red-team tools like SharpUp or PowerSploit.
  • **Filter/