Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based Red and Black team tools that expose unique TypeLibGUID artifacts to evade standard signature-based detection. Proactively hunting for these specific GUIDs in Azure Sentinel allows the SOC team to identify stealthy reconnaissance or post-exploitation activities before they escalate into critical incidents, even when initial rule severity is low.

YARA Rule

rule HKTL_NET_GUID_Rubeus {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/Rubeus"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "658c8b7f-3664-4a95-9572-a3e5871dfc06" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/GhostPack/Rubeus
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Microsoft Endpoint Configuration Manager (MECM/SCCM) Software Updates

  • Scenario: The SCCM client service (ccmexec.exe) or the Windows Update agent frequently loads C# assemblies containing specific TypelibGUIDs during routine software deployment, patch installation, and compliance reporting cycles. This often occurs on a large scale across the enterprise fleet at scheduled maintenance windows (e.g., 2:00 AM daily).
  • Filter/Exclusion: Create an exclusion for processes originating from the C:\Windows\CCM or C:\Program Files (x86)\Microsoft Intune Management Extension directories. Additionally, filter by process name ccmexec.exe, WuaUspSvc.exe, and MsMpEng.exe.

• Visual Studio Build Automation & CI/CD Pipelines

  • Scenario: In development environments or build servers (e.g., Azure DevAgents, Jenkins agents), the compilation of C# projects triggers the loading of the .NET runtime libraries. Tools like msbuild.exe, dotnet.exe, and specific Red Team testing frameworks (such as SharpUp or Cobalt Strike’s Beacon in a non-malicious build context) generate these GUIDs during legitimate code compilation, unit testing, and artifact packaging tasks.
  • Filter/Exclusion: Exclude traffic from known CI/CD server hostnames or IP ranges (e.g., *.build.contoso.com). Filter by process names including msbuild.exe, dotnet.exe, and vstest.console.exe running under service accounts like NT AUTHORITY\Network Service or specific build user accounts.

• **Microsoft Defender for Endpoint (