Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging custom or open-source C# tools for reconnaissance and lateral movement that share specific typelibguid signatures within the NET_GUID malware family. Proactively hunting these artifacts in Azure Sentinel is critical because their legitimate appearance often allows attackers to evade standard signature-based defenses, requiring behavioral analysis to distinguish between authorized red-team exercises and malicious black-team operations.

YARA Rule

rule HKTL_NET_GUID_Offensive__NET {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/mrjamiebowman/Offensive-.NET"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "11fe5fae-b7c1-484a-b162-d5578a802c9c" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/mrjamiebowman/Offensive-.NET
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects c# red/black-team tools via typelibguid rule in an enterprise environment, along with suggested filters:

• Scheduled .NET Framework Update Tasks

  • Scenario: Enterprise patch management systems (e.g., SCCM or Intune) frequently trigger background processes to install or verify .NET Framework updates. These legitimate update agents often load C# assemblies containing standard typelibguid signatures that overlap with the NET_GUID family, specifically during the installation of Microsoft.Windows.Update.Agent or similar system components on Windows 10/11 endpoints.
  • Suggested Filter: Exclude processes originating from trusted vendor paths (e.g., C:\Windows\SoftwareDistribution\*, C:\Program Files\Microsoft Intune Agent\*) and specifically whitelist the parent process name TrustedInstaller.exe or AgentService.exe.

• Internal DevOps Build Pipelines

  • Scenario: In organizations with internal CI/CD pipelines (using tools like Jenkins, Azure DevOps, or GitHub Actions), build agents often execute C# compilation tasks. These agents utilize the dotnet CLI and MSBuild, which dynamically load libraries containing standard .NET type library GUIDs. When these agents run on shared infrastructure or jump servers, they generate high volumes of legitimate C# activity that mimics the signature of red-team reconnaissance tools.
  • Suggested Filter: Create an exclusion based on the user context (e.g., SYSTEM, Network Service, or specific service accounts like svc-build-agent) and filter by command line arguments containing known build flags such as /t:Build or dotnet publish.

• Microsoft 365 Copilot and Office Add-ins

  • Scenario: The deployment of Microsoft 365 Copilot or complex Excel/PowerPoint add-ins