Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these specific tool identifiers allows the SOC team to distinguish between legitimate security testing operations and suspicious reconnaissance or lateral movement attempts that may mimic standard administrative behavior.

YARA Rule

rule HKTL_NET_GUID_fakelogonscreen {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/bitsadmin/fakelogonscreen"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "d35a55bd-3189-498b-b72f-dc798172e505" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/bitsadmin/fakelogonscreen
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated .NET Deployment Pipelines

  • Context: CI/CD agents (e.g., Azure DevOps or GitHub Actions runners) executing msbuild or custom C# deployment scripts often instantiate standard .NET assemblies that share the same TypelibGUIDs as known red-team tools like Cobalt Strike’s Beacon or SharpUp.
  • Filter/Exclusion: Exclude processes running under specific service accounts (e.g., AZURE-DEVOPS-BUILD-SVC) and restrict detection to non-build server hostnames. Alternatively, filter out events where the parent process is msbuild.exe or dotnet.exe.

• Scenario: Enterprise Endpoint Protection Scanning

  • Context: Endpoint Detection and Response (EDR) agents such as CrowdStrike Falcon or Microsoft Defender for Endpoint frequently load C# management modules to perform real-time scanning. These modules often utilize the same COM interfaces (TypelibGUIDs) used by black-team tools like SharpHound or Bloodhound.
  • Filter/Exclusion: Create an exclusion list for known EDR process names (e.g., FalconSensor.exe, MsMpEng.exe) and their child processes. Additionally, exclude events where the command line contains keywords specific to scanning operations (e.g., “scan”, “update”, “policy”).

• Scenario: Scheduled PowerShell Health Checks

  • Context: IT Operations teams often schedule nightly PowerShell scripts using System.Management.Automation to query Active Directory or inventory hardware. These scripts invoke C# assemblies that mimic the TypelibGUID signatures of tools like SharpDump or PowerSploit components.
  • Filter/Exclusion: Filter out events occurring during defined maintenance