Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that register unique TypeLibGUIDs to establish persistence or execute reconnaissance within the Azure environment. Proactively hunting for these specific GUID signatures in Azure Sentinel is critical because they often indicate early-stage tool deployment by threat actors before malicious activity escalates, allowing the SOC team to validate legitimate operations against potential stealthy intrusions.

YARA Rule

rule HKTL_NET_GUID_dotnet_gargoyle {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/countercept/dotnet-gargoyle"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "76435f79-f8af-4d74-8df5-d598a551b895" ascii nocase wide
        $typelibguid1 = "5a3fc840-5432-4925-b5bc-abc536429cb5" ascii nocase wide
        $typelibguid2 = "6f0bbb2a-e200-4d76-b8fa-f93c801ac220" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://github.com/countercept/dotnet-gargoyle
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Automated Patch Management Deployment

  • Context: Enterprise patch management systems (e.g., Microsoft Endpoint Configuration Manager (SCCM) or Ivanti) often utilize C# executables to query system inventory, check for updates, and deploy patches. These tools frequently instantiate .NET assemblies that generate specific typelibguid values during the installation phase of a scheduled maintenance window.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (e.g., ccmexec.exe, IvantiAgentService.exe) and restrict detection to non-business hours or specific Source IPs belonging to the Patch Management Server subnet.

• Scenario: Scheduled Backup Verification Jobs

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault run nightly C#-based verification scripts that validate data integrity and inventory consistency. These jobs often load specific .NET libraries to interact with the OS registry, triggering the typelibguid signature associated with Red/Blue team analysis tools, even though they are standard maintenance operations.
  • Filter/Exclusion: Filter by Parent Process ID (PPID) or Command Line Arguments. Exclude events where the command line contains keywords such as “verify,” “inventory,” or specific job IDs known to be part of the backup schedule, and ensure the process is running under a dedicated service account (e.g., svc_backup_admin).

• Scenario: Endpoint Security Agent Self-Updates

  • Context: Next-generation antivirus and EDR platforms (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) perform self-updates using C