Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects the execution of specialized C# Red and Black team security tools by identifying their unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC to distinguish between legitimate security operations and potential adversary activity that mimics trusted tooling, thereby reducing false positives and enhancing situational awareness during internal exercises or attacks.

YARA Rule

rule HKTL_NET_GUID_HiveJack {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Viralmaniar/HiveJack"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "e12e62fe-bea3-4989-bf04-6f76028623e3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/Viralmaniar/HiveJack
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: CI/CD agents (e.g., Jenkins, Azure DevOps) running on build servers frequently instantiate C# assemblies to compile code or run unit tests. These processes often load standard .NET typelibs that match the rule’s signature for security tools.
  • Filter/Exclusion: Exclude process paths containing Jenkins, AzureDevOps, or MSBuild from the detection logic, specifically when the parent process is a known service account (e.g., NT SERVICE\jenkins).

• Scenario: Scheduled Office 365 Compliance Scans

  • Context: Microsoft Defender for Cloud Apps or third-party compliance tools (like Varonis) run scheduled C# scripts to audit file permissions and DLP policies. These scans utilize specific typelib GUIDs that overlap with Red Team tool signatures during their daily execution windows.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 02:00–04:00 UTC) for processes named ComplianceScanner.exe or Office365Connector.exe, ensuring the rule only triggers outside these maintenance hours.

• Scenario: Endpoint Antivirus Heuristic Scanning

  • Context: Enterprise EDR solutions (e.g., CrowdStrike, SentinelOne) perform deep heuristic scans on .NET applications. During these scans, the antivirus engine may inject a C# module that generates a typelib GUID identical to those used by common Red Team tools like SharpUp or PowerSploit.
  • Filter/Exclusion: Exclude events where the Parent_Process_Name is the specific EDR agent (e.g., `