Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based Red and Black team tools that generate unique typelibguid artifacts to execute reconnaissance or post-exploitation activities within the Azure environment. Proactively hunting for these specific identifiers in Azure Sentinel allows the SOC team to distinguish legitimate security tooling from malicious C# payloads, ensuring early visibility into potential lateral movement or data exfiltration attempts before they escalate.

YARA Rule

rule HKTL_NET_GUID_WindowsDefender_Payload_Downloader {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/notkohlrexo/WindowsDefender-Payload-Downloader"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "2f8b4d26-7620-4e11-b296-bc46eba3adfc" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/notkohlrexo/WindowsDefender-Payload-Downloader
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated CI/CD Build Pipelines (Jenkins/GitLab)

  • Context: Enterprise build agents frequently execute .NET compilation tasks using MSBuild or dotnet.exe. These tools load standard C# runtime libraries that share the same TypelibGUIDs as offensive security frameworks (e.g., Covenant, SharpUp) during dependency resolution.
  • Filter/Exclusion: Exclude processes running from known CI/CD agent service accounts (e.g., Jenkins-Agent-01, GitLab-Runner) and restrict the rule to only trigger on user-initiated sessions rather than background build services.

• Scenario: Scheduled Office 365 ProPlus Updates

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) or scheduled update tasks often instantiate C# components for configuration management. These components utilize standard .NET Framework GUIDs that overlap with the signatures of red-team tools like SharpHound (BloodHound) or GRR.
  • Filter/Exclusion: Create an exclusion for the parent process OfficeClickToRun.exe and specific scheduled task names containing “Microsoft Office” or “Update Task,” ensuring only unexpected execution paths trigger alerts.

• Scenario: Endpoint Management Agent Heartbeats (Intune/SCCM)

  • Context: Enterprise management agents like Microsoft Intune (IntuneManagementExtension) or SCCM Client (ccmexec.exe) regularly run C# scripts to inventory software and check compliance. These internal tools often load the same TypelibGUIDs used by black-team reconnaissance tools (e.g., PowerView, BloodHound).