Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for C# Red and Black team tools that utilize specific TypeLibGUID identifiers within the Azure Sentinel environment. Proactively hunting for these signatures is essential to distinguish between legitimate security testing operations and malicious reconnaissance or tool deployment attempts that may otherwise blend into routine system noise.

YARA Rule

rule HKTL_NET_GUID_MemoryMapper {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jasondrawdy/MemoryMapper"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "b9fbf3ac-05d8-4cd5-9694-b224d4e6c0ea" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/jasondrawdy/MemoryMapper
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, along with suggested filters:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Jenkins, Azure DevOps) running on Windows hosts frequently compile C# solutions or execute unit tests using the .NET SDK. This triggers the creation of temporary TypeLib GUIDs that mimic Red Team tool signatures during the build process.
  • Suggested Filter: Exclude processes originating from known CI/CD service accounts (e.g., NT SERVICE\Jenkins, AZDO-AGENT) and restrict detection to exclude paths within standard build directories like C:\Program Files\Microsoft Visual Studio or D:\Builds.

• Scenario: Microsoft Endpoint Manager (Intune) Policy Deployment

  • Context: The Intune management agent (Microsoft.IntuneManagementAgent.exe) often deploys C# based configuration scripts and compliance checks. These scripts instantiate COM objects with specific TypeLib GUIDs that overlap with the rule’s detection logic for security tools.
  • Suggested Filter: Create an exclusion for the process name MicrosoftIntuneManagementAgent.exe and filter out events where the parent process is CcmExec.exe (System Center Configuration Manager) or MsMpEng.exe (Windows Defender).

• Scenario: Scheduled PowerShell Health Checks

  • Context: Internal IT operations run nightly scheduled tasks using PowerShell to query system health. These scripts often load C# assemblies for reporting, generating TypeLib GUIDs that the rule interprets as active Red Team reconnaissance tools.
  • Suggested Filter: Exclude events where the command line arguments contain keywords like HealthCheck, ReportGeneration, or specific internal script paths (e.g., `C:\Scripts\Ops\DailyCheck