Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection rule identifies the execution of specialized C# red and black team tools by analyzing unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC team to distinguish legitimate security testing activities from potential adversary reconnaissance or tool deployment that mimics standard administrative behavior.

YARA Rule

rule HKTL_NET_GUID_Mythic {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/its-a-feature/Mythic"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "91f7a9da-f045-4239-a1e9-487ffdd65986" ascii nocase wide
        $typelibguid1 = "0405205c-c2a0-4f9a-a221-48b5c70df3b6" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/its-a-feature/Mythic
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID,” including targeted filters and exclusions:

• Scenario: Microsoft Visual Studio Build & Deployment Processes

  • Context: Automated CI/CD pipelines or developer workstations running msbuild.exe or devenv.exe often instantiate C# assemblies that register specific TypeLib GUIDs (e.g., related to .NET Framework or Azure SDKs) which overlap with Red Team tool signatures. This is common during nightly build jobs or when developers compile large solutions.
  • Suggested Filter/Exclusion: Exclude processes where the parent process is msbuild.exe, devenv.exe, or dotnet.exe running within known CI/CD service accounts (e.g., DOMAIN\BuildService). Alternatively, filter out TypeLibGUIDs associated with standard Microsoft .NET assemblies that are not part of the specific Red Team tool list.

• Scenario: Scheduled Office 365 / SharePoint Provisions

  • Context: Enterprise environments often run scheduled PowerShell jobs or background services (like OfficeClientService.exe or SharePoint Timer Service) that utilize C# components for provisioning, syncing, or updating user profiles. These tools frequently load TypeLibs that mimic the GUID structure of security testing tools like Cobalt Strike or SharpUp.
  • Suggested Filter/Exclusion: Create an exclusion based on the executable path containing \Program Files\Microsoft Office or \Program Files\Common Files\Microsoft Shared. Additionally, exclude events occurring during known maintenance windows (e.g., 02:00–04:00 UTC) where these provisioning jobs are active.

• Scenario: Endpoint Protection Agent Updates

  • Context: Modern EDR agents (such as CrowdStrike Falcon, Microsoft Defender for Endpoint,