Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for specific TypeLibGUID signatures associated with common C# Red and Blue team utility tools often used during reconnaissance or post-exploitation phases. Proactively hunting for these indicators in Azure Sentinel allows the SOC to distinguish between legitimate administrative operations and suspicious tool usage that may signal an attacker leveraging familiar frameworks to evade detection.

YARA Rule

rule HKTL_NET_GUID_PoshSecFramework {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/PoshSec/PoshSecFramework"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "b1ac6aa0-2f1a-4696-bf4b-0e41cf2f4b6b" ascii nocase wide
        $typelibguid1 = "78bfcfc2-ef1c-4514-bce6-934b251666d2" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/PoshSec/PoshSecFramework
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: Continuous Integration/Continuous Deployment (CI/CD) servers (e.g., Azure DevOps, Jenkins) frequently execute .NET-based build agents that instantiate C# libraries to compile code or run unit tests. These agents often load specific TypeLibGUIDs associated with testing frameworks like NUnit or xUnit, which mimic the behavior of security scanning tools.
  • Suggested Filter: Exclude processes running under the SYSTEM account or specific service accounts (e.g., AZDO-BUILD-SVC) located within the C:\BuildAgents\ directory path.

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Deployment

  • Context: During scheduled software deployment windows, SCCM clients utilize C# components to manage application installations and inventory scans. The client service (ccmexec.exe) often loads TypeLibGUIDs related to Microsoft’s management infrastructure, which can be misidentified as external red-team reconnaissance tools.
  • Suggested Filter: Create an exclusion for the executable path C:\Program Files (x86)\Microsoft Configuration Manager\ccmexec.exe and restrict detection to non-business hours if the alert is triggered during known maintenance windows.

• Scenario: Enterprise Antivirus Heuristic Scanning

  • Context: Modern EDR solutions (such as CrowdStrike Falcon or Microsoft Defender for Endpoint) perform deep heuristic scans on .NET assemblies. These engines often inject C# monitoring modules that utilize TypeLibGUIDs to inspect memory and file integrity, triggering the rule when they scan their own processes or other critical system services.
  • Suggested Filter: Exclude known EDR process names (e.g., `Cns