Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these specific identifiers is essential to distinguish legitimate security tooling from malicious C# processes that may mimic known good applications to evade detection.

YARA Rule

rule HKTL_NET_GUID_DotNetToJScript {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/tyranid/DotNetToJScript"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "7e3f231c-0d0b-4025-812c-0ef099404861" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/tyranid/DotNetToJScript
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters or exclusions:

• Scenario: Microsoft Office Deployment Toolkit (ODT) Execution

  • Context: During scheduled maintenance windows, IT administrators run OfficeDeploymentTool.exe to push updates or install new Office versions across the fleet. This C# tool registers specific TypeLibGUIDs that match the rule’s signature for red-team automation tools.
  • Filter/Exclusion: Create an exclusion based on the executable path C:\Program Files (x86)\Microsoft Office Deployment Tool\OfficeDeploymentTool.exe and restrict the alert to non-business hours or specific maintenance groups.

• Scenario: Azure DevOps Build Agent Activity

  • Context: In a CI/CD environment, hosted build agents frequently execute C# scripts using msbuild or custom PowerShell wrappers that load .NET assemblies with TypeLibGUIDs similar to those used by black-team reconnaissance tools (e.g., for dependency analysis).
  • Filter/Exclusion: Exclude processes running under the user context of the build service account (e.g., NT SERVICE\TeamFoundationBuildAgent) and filter out events originating from the Azure DevOps agent directory path.

• Scenario: Automated Backup Verification Scripts

  • Context: Enterprise backup solutions (such as Veeam or Commvault) often utilize C# helper utilities to verify database integrity or manage snapshots. These utilities instantiate COM objects with TypeLibGUIDs that overlap with the detection logic for red-team data exfiltration tools.
  • Filter/Exclusion: Implement a filter excluding processes where the parent process is vssvc.exe (Volume Shadow Copy Service) or specific backup service executables like Veeam.Backup.Service.exe.

• Scenario: Endpoint D