Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting the presence of known C# red and blue team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these indicators is essential to distinguish legitimate security operations from malicious tool usage that may mimic standard administrative behavior, thereby reducing false positives and uncovering stealthy threat actor movements.

YARA Rule

rule HKTL_NET_GUID_Inception {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/two06/Inception"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "03d96b8c-efd1-44a9-8db2-0b74db5d247a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/two06/Inception
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Deployment of Microsoft Teams or Office 365 ProPlus Updates

  • Context: The Microsoft.Update.Client service or scheduled update jobs often utilize C# assemblies with specific TypeLibGUIDs that overlap with known security tool signatures during the installation or configuration phase.
  • Filter/Exclusion: Exclude processes running under the C:\Program Files\Microsoft Office\root\Office16\ and C:\Program Files\Microsoft Teams\ paths, specifically filtering for TypeLibGUIDs associated with System.Windows.Forms or Microsoft.Office.Core.

• Scenario: Execution of Internal CI/CD Pipeline Agents (e.g., Jenkins, Azure DevOps)

  • Context: Build agents running on Windows servers frequently execute C#-based build tasks (MSBuild, NuGet restore) that instantiate TypeLibGUIDs matching the rule’s detection logic while compiling or testing internal applications.
  • Filter/Exclusion: Create an exclusion for process names containing msbuild.exe, dotnet.exe, or vstest.console.exe when running within designated build server hostnames (e.g., BUILD-SRV-01) or specific service accounts like NT SERVICE\Jenkins.

• Scenario: Scheduled Inventory and Asset Management Scans

  • Context: Enterprise asset management tools (such as Lansweeper, SCCM/MECM, or ManageEngine) run nightly C# agents to inventory hardware/software. These agents often load TypeLibGUIDs identical to those used by Red Team simulation tools during their discovery phase.
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe (SCCM), `