Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity by monitoring for specific TypeLibGUID signatures associated with known C# red and black team reconnaissance or attack tools within Azure Sentinel environments. Proactive hunting for these indicators is essential to uncover stealthy tool deployment that may evade standard signature-based controls, allowing the SOC to validate legitimate administrative actions against potential early-stage threat presence.

YARA Rule

rule HKTL_NET_GUID_SneakyService {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/malcomvetter/SneakyService"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "897819d5-58e0-46a0-8e1a-91ea6a269d84" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid”, including suggested filters and exclusions:

Scenario: Automated CI/CD Pipeline Execution
- Context: Build agents (e.g., Jenkins, Azure DevOps) on build servers frequently invoke C# compilation tools or unit test runners that instantiate .NET assemblies with specific TypelibGUIDs matching known security tool signatures.
- Suggested Filter/Exclusion: Exclude process paths containing standard CI/CD directories (e.g., \AzureDevOps\, \Jenkins\workspace\) and restrict the rule to trigger only on interactive user sessions, excluding service accounts like SYSTEM or specific build service accounts (e.g., svc-build-agent).
Scenario: Scheduled Antivirus Definition Updates
- Context: Enterprise Endpoint Protection suites (such as Microsoft Defender for Endpoint or CrowdStrike) often use C# wrappers to manage definition updates. These background services may load libraries with GUIDs that overlap with Red/Black team tool signatures during their nightly update cycles.
- Suggested Filter/Exclusion: Create an exclusion based on the parent process name (e.g., MsMpEng.exe, CcmExec.exe) and exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 local time) for these specific service accounts.
Scenario: Enterprise Configuration Management Tools
- Context: IT Operations teams utilize C#-based automation frameworks like SCCM (System Center Configuration Manager) or Ansible Tower to deploy software updates and policy configurations. These tools often instantiate .NET objects that generate the same TypelibGUID patterns as security assessment tools during mass deployment tasks.
- Suggested Filter/Exclusion: Filter out events where the command line