Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these specific tool identifiers allows the SOC team to distinguish between legitimate security operations and covert malicious reconnaissance or post-exploitation activities that often mimic standard administrative behavior.

YARA Rule

rule HKTL_NET_GUID_VanillaRAT {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/DannyTheSloth/VanillaRAT"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "d0f2ee67-0a50-423d-bfe6-845da892a2db" ascii nocase wide
        $typelibguid1 = "a593fcd2-c8ab-45f6-9aeb-8ab5e20ab402" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/DannyTheSloth/VanillaRAT
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” along with suggested filters or exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Jenkins, Azure DevOps, GitHub Actions) running automated unit tests or integration scans using C# frameworks like NUnit or xUnit. These tools often load specific COM typelibs during the test initialization phase to validate assembly references, mimicking Red Team reconnaissance behavior.
  • Suggested Filter: Exclude processes originating from known CI/CD service accounts (e.g., SYSTEM, NetworkService) running on designated build server hostnames or within a specific subnet (e.g., 10.20.x.x).

• Scenario: Enterprise Endpoint Protection Scanning

  • Context: Next-generation antivirus solutions (such as Microsoft Defender for Endpoint, CrowdStrike Falcon, or Carbon Black) performing real-time heuristic scans on .NET assemblies. The EDR agent may instantiate C# typelib GUIDs to inspect the internal structure of managed executables, triggering the rule when scanning heavily instrumented applications like Office 365 or custom ERP clients.
  • Suggested Filter: Exclude process paths belonging to known security vendors (e.g., C:\Program Files\Microsoft Defender\*, C:\ProgramData\CrowdStrike\*\falcon.sys) and filter out events where the parent process is a recognized EDR sensor service.

• Scenario: Scheduled PowerShell Maintenance Jobs

  • Context: Administrators running scheduled maintenance scripts using PowerShell (which utilizes the .NET runtime) to perform inventory collection, license auditing, or configuration drift analysis. These scripts often invoke COM objects with specific typelib GUIDs to interact with Active Directory or SQL Server, resembling Black Team data gathering tools.

  ---