Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these specific identifiers allows the SOC team to distinguish between legitimate security testing operations and malicious tool usage that may mimic standard administrative behavior, thereby reducing false positives and accelerating incident response.

YARA Rule

rule HKTL_NET_GUID_PoshC2_Misc {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/nettitude/PoshC2_Misc"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "85773eb7-b159-45fe-96cd-11bad51da6de" ascii nocase wide
        $typelibguid1 = "9d32ad59-4093-420d-b45c-5fff391e990d" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/nettitude/PoshC2_Misc
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters or exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: DevOps agents (e.g., Jenkins, Azure DevOps, GitHub Actions) frequently compile C# projects and run unit tests on build servers. These processes often instantiate standard .NET assemblies that share the same typelibguid as known security tools like Cobalt Strike Beacon, SharpUp, or PowerSploit.
  • Filter/Exclusion: Create an exclusion based on the Process Image Path and User Account. Exclude alerts where the process path contains *\build\*, *\agent\*, or *\svc-build and the user account is a dedicated service account (e.g., NT SERVICE\Jenkins or svc-cicd).

• Scenario: Scheduled Microsoft Defender for Endpoint Scans

  • Context: During scheduled antimalware scans, the Microsoft Defender engine utilizes C# components to analyze file integrity and memory. The scan process often loads specific .NET libraries that match the typelibguid signatures used by red-team tools like SharpHound or BloodHound.
  • Filter/Exclusion: Implement a filter targeting the Parent Process Name. Exclude events where the parent process is MsMpEng.exe (Microsoft Defender) or SenseService.exe, as these are legitimate security scanning engines rather than adversarial tooling.

• Scenario: Enterprise Backup and Archiving Jobs

  • Context: Legacy enterprise backup solutions (e.g., Veeam, Commvault, or custom PowerShell scripts wrapping C# libraries) often utilize .NET frameworks to manage file metadata and compression. These tools may trigger the detection logic when they instantiate