Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity involving C#-based red and black team tools by monitoring unique TypeLibGuid artifacts often used during reconnaissance or post-exploitation phases. Proactively hunting for these signatures in Azure Sentinel is essential to distinguish legitimate security testing from potential malicious tool deployment, ensuring that low-severity indicators of advanced threat operations are not overlooked.

YARA Rule

rule HKTL_NET_GUID_DotNetAVBypass_Master {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/lockfale/DotNetAVBypass-Master"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "4854c8dc-82b0-4162-86e0-a5bbcbc10240" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/lockfale/DotNetAVBypass-Master
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: In a DevOps environment, CI/CD agents (e.g., Jenkins or Azure DevOps) frequently compile .NET applications. During the build process, the compiler (csc.exe) or MSBuild invokes the System.Reflection library to inspect assemblies, generating specific typelibguid values associated with standard C# development tooling rather than adversarial activity.
  • Suggested Filter: Exclude processes where the parent image path contains \Program Files\Microsoft Visual Studio\ or \Azure DevOps Agent\, and restrict detection to non-standard user accounts (e.g., exclude SYSTEM and NETWORK SERVICE).

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, perform scheduled deep scans. These agents often utilize C#-based modules to analyze file metadata and registry keys, triggering the typelibguid signature when scanning .NET binaries on the host machine.
  • Suggested Filter: Create an exclusion based on the process name (e.g., MsMpEng.exe, Cortex.sys) or specific command-line arguments containing keywords like /scan, /scheduled, or /maintenance.

• Scenario: Corporate Software Deployment via SCCM/Intune

  • Context: During business hours, System Center Configuration Manager (SCCM) or Microsoft Intune pushes updates for internal line-of-business applications. The deployment client (ccmexec.exe or DeviceManagementClient) executes C# scripts to register new software components in the Windows Registry, which generates the specific GUIDs associated with Red/Blue team