Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects the execution of C#-based red and black team tools by identifying unique TypeLibGUID signatures often associated with security testing frameworks. Proactive hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate security assessments from potential adversary activity that mimics known tooling behaviors to evade detection.

YARA Rule

rule HKTL_NET_GUID_rundotnetdll32 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xbadjuju/rundotnetdll32"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "a766db28-94b6-4ed1-aef9-5200bbdd8ca7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/0xbadjuju/rundotnetdll32
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, along with suggested filters or exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Azure DevOps Agents, Jenkins nodes) frequently compile C# projects using MSBuild or dotnet cli. These tools load standard .NET assemblies that contain specific TypeLibGUIDs often flagged as security tool signatures.
  • Suggested Filter/Exclusion: Exclude processes running under the service account of your CI/CD platform (e.g., AZURE-AGENT-SVC, Jenkins) or restrict detection to exclude paths containing \BuildAgents\ and \jenkins-agent\.

• Scenario: Scheduled Antivirus Database Updates

  • Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, utilize C# components during their scheduled definition update cycles. These updates often instantiate COM objects with TypeLibGUIDs that overlap with Red/Blue team tool signatures.
  • Suggested Filter/Exclusion: Create an exclusion based on the parent process name (e.g., C:\Program Files\CrowdStrike\csagent.exe or MsMpEng.exe) and time-based filtering to ignore alerts occurring during known maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Office 365 Add-in Initialization

  • Context: When users launch Microsoft Office applications (Word, Excel) with enterprise-wide C# add-ins (e.g., custom document management tools or compliance checkers), the host process (WINWORD.EXE, EXCEL.EXE) loads these add-ins. The initialization of these add-ins triggers TypeLibGUID events that mimic