Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies the execution of specialized C# Red and Black team tools by analyzing unique TypeLibGUID signatures often used during security assessments or active adversary operations. Proactively hunting for these indicators in Azure Sentinel enables the SOC to distinguish between legitimate testing activities and potential reconnaissance efforts, ensuring that tool usage aligns with authorized maintenance windows and known inventory.

YARA Rule

rule HKTL_NET_GUID_SharpAdidnsdump {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/b4rtik/SharpAdidnsdump"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "cdb02bc2-5f62-4c8a-af69-acc3ab82e741" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/b4rtik/SharpAdidnsdump
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid”, including suggested filters or exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Azure DevOps, Jenkins) running C# unit tests or compiling code using dotnet CLI or MSBuild on build servers. These processes often instantiate standard .NET assemblies that match the typelibGUIDs associated with security tools.
  • Filter/Exclusion: Exclude process names containing msbuild.exe, dotnet.exe, and vstest.console.exe running under service accounts (e.g., NT SERVICE\BuildAgent) on known build server hostnames.

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Application Deployment

  • Context: SCCM clients executing C#-based application installers or custom scripts that utilize the .NET Framework to query system state. These deployments often trigger typelibGUIDs similar to those used by Red Team simulation tools during installation or configuration phases.
  • Filter/Exclusion: Create an exclusion for processes named ccmexec.exe and smsengine.exe where the parent process is ccmsetup.exe, specifically targeting the “System Center Configuration Manager” product line in the registry path.

• Scenario: Scheduled PowerShell Health Checks

  • Context: A nightly scheduled task running a custom C# health monitoring script (e.g., checking disk space, service status) that loads specific .NET libraries. The script’s execution generates typelibGUIDs indistinguishable from Red Team reconnaissance tools like BloodHound or Lateral Movement utilities.
  • Filter/Exclusion: Exclude events where the process name is powershell.exe and the command line contains keywords such as “HealthCheck”,