Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity involving C# Red/Black team tools by analyzing unique TypeLibGUID signatures within the Azure Sentinel environment. Proactive hunting for these indicators is essential to distinguish legitimate security testing from potential malicious reconnaissance or tool deployment that may evade standard signature-based defenses.

YARA Rule

rule HKTL_NET_GUID_ManagedInjection {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/malcomvetter/ManagedInjection"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "e5182bff-9562-40ff-b864-5a6b30c3b13b" ascii nocase wide
        $typelibguid1 = "fdedde0d-e095-41c9-93fb-c2219ada55b1" ascii nocase wide
        $typelibguid2 = "0dd00561-affc-4066-8c48-ce950788c3c8" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://github.com/malcomvetter/ManagedInjection
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects c# red/black-team tools via typelibguid rule, including suggested filters and exclusions:

• Scenario: Microsoft Visual Studio Build Processes

  • Context: During active development or CI/CD pipelines, devenv.exe (Visual Studio) or msbuild.exe frequently instantiates .NET assemblies that generate unique TypeLib GUIDs similar to those used by offensive tools like Cobalt Strike’s Beacon or Mimikatz. This often occurs when developers compile C# projects containing reflection-heavy libraries.
  • Filter/Exclusion: Exclude processes running under the C:\Program Files\Microsoft Visual Studio\ and C:\Windows\Microsoft.NET\Framework64\v* paths, specifically filtering for parent process names devenv.exe, msbuild.exe, or dotnet.exe.

• Scenario: Office 365 Click-to-Run Updates

  • Context: The Microsoft Office update service (OfficeClickToRun.exe) and associated background tasks often load C# components to manage licensing, telemetry, and feature updates. These components register TypeLib GUIDs that can mimic the signature of red-team tools like SharpUp or PowerSploit modules.
  • Filter/Exclusion: Create an exclusion for process names containing OfficeClickToRun, OsfClient.exe (OneDrive), and Groove.exe when they are executing under the user context of a standard domain-joined workstation, excluding them from the rule’s scope during business hours.

• Scenario: Scheduled Antivirus or EDR Scans

  • Context: Enterprise Endpoint Detection and Response (EDR) agents (e.g., CrowdStrike Falcon Sensor, SentinelOne, or Carbon Black) often include C# based scanning engines that interact with the .NET runtime to analyze file integrity.