This hunt hypothesis posits that adversaries are leveraging C#-based red and black team tools to establish persistence or conduct reconnaissance by registering unique TypeLibGUIDs within the Windows environment. Proactively hunting for these specific GUID signatures in Azure Sentinel is critical because they often indicate the early deployment of custom tooling that may evade standard signature-based detection, allowing the SOC to identify potential threat actor activity before it escalates into a confirmed incident.
rule HKTL_NET_GUID_DreamProtectorFree {
meta:
description = "Detects c# red/black-team tools via typelibguid"
reference = "https://github.com/Paskowsky/DreamProtectorFree"
author = "Arnim Rupp"
date = "2020-12-13"
strings:
$typelibguid0 = "f7e8a902-2378-426a-bfa5-6b14c4b40aa3" ascii nocase wide
condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters and exclusions:
Scenario: Automated Patch Deployment via SCCM/MECM
ccmexec.exe) or the Microsoft Endpoint Configuration Manager agent executes C#-based deployment scripts to install security updates. These scripts often instantiate .NET assemblies that generate specific TypeLib GUIDs associated with Red Team tooling libraries during the installation handshake.C:\Program Files (x86)\Microsoft Configuration Manager\ or specifically targeting the executable path *ccmexec.exe. Additionally, filter by user context to exclude actions run under the SYSTEM account during standard maintenance windows (e.g., 02:00–04:00 UTC).Scenario: Microsoft Defender for Endpoint Real-Time Scanning
MsMpEng.exe) utilizes internal C# components to perform heuristic analysis and threat emulation. When scanning large enterprise directories, the engine may load TypeLib GUIDs that overlap with those used by common Red Team tools (like Cobalt Strike or Empire) to verify file integrity, triggering a match even though no adversarial activity is present.MsMpEng.exe and the command line arguments contain keywords related to scheduled scans (e.g., -ScanType=Quick, -ScanType=Full). Implement a filter that suppresses alerts if the detected GUID matches known Microsoft-signed assemblies within the Defender installation directory.Scenario: CI/CD Pipeline Build Agents (Azure DevOps / Jenkins)