Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these specific tool indicators allows the SOC team to distinguish between legitimate security operations and malicious reconnaissance or lateral movement attempts that mimic standard administrative workflows.

YARA Rule

rule HKTL_NET_GUID_MinerDropper {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/DylanAlloy/MinerDropper"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "46a7af83-1da7-40b2-9d86-6fd6223f6791" ascii nocase wide
        $typelibguid1 = "8433a693-f39d-451b-955b-31c3e7fa6825" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/DylanAlloy/MinerDropper
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” including targeted filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build servers (e.g., Jenkins, Azure DevOps) frequently execute C# compilation tasks using msbuild.exe or dotnet.exe. These processes often instantiate specific .NET assemblies that generate unique TypeLibGUIDs matching the rule’s signature.
  • Filter/Exclusion: Create an exclusion based on the Process Name (msbuild.exe, dotnet.exe) AND Parent Process (e.g., Jenkins.exe or VSTestRunner.exe). Additionally, restrict detection to exclude processes running within specific “Build Agent” service accounts.

• Scenario: Scheduled Office 365/SharePoint Provisioning Jobs

  • Context: Enterprise environments often run nightly scheduled tasks using PowerShell scripts that invoke C# libraries for SharePoint or Exchange management (e.g., Microsoft.SharePoint.Client.dll). These background jobs trigger the TypeLibGUID detection as they load specific COM interfaces.
  • Filter/Exclusion: Implement a filter excluding events where the User Account is a known service account (e.g., svc-sharepoint-provisioning) and the Process Path resides in a standard administrative directory (e.g., C:\Program Files\Microsoft Office Server 16).

• Scenario: Endpoint Protection or Backup Agent Updates

  • Context: Major security suites like CrowdStrike, Carbon Black, or backup agents like Veeam often utilize C# components for their update mechanisms and policy enforcement engines. When these agents perform routine health checks or signature updates, they instantiate the same TypeLibGUIDs used by red-team tools.
  • Filter/Exclusion: Exclude