Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based offensive and defensive tools that expose unique typelibguid identifiers to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific artifacts in Azure Sentinel is critical because their presence often indicates early-stage tool deployment by threat actors, allowing the SOC team to validate legitimate usage versus potential malicious activity before escalation occurs.

YARA Rule

rule HKTL_NET_GUID_AggressorScripts {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/harleyQu1nn/AggressorScripts"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "afd1ff09-2632-4087-a30c-43591f32e4e8" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/harleyQu1nn/AggressorScripts
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, tailored for an enterprise environment:

• Scheduled Office 365 ProPlus Updates

  • Scenario: The Microsoft Update Agent or a third-party patch management system (e.g., SCCM) triggers msiexec.exe or OfficeClickToRun.exe to install or repair the Office suite. These processes load C# assemblies containing specific TypeLib GUIDs associated with internal productivity tooling that overlap with Red Team signatures.
  • Filter/Exclusion: Exclude process paths containing \Microsoft Office\root\Office*\ and parent processes ccmexec.exe (SCCM) or UpdateOrchestrator.exe.

• Automated PowerShell Script Execution by IT Admins

  • Scenario: An IT administrator runs a scheduled maintenance script using the .NET Framework to query Active Directory user attributes or manage Group Policy. The script invokes a custom C# helper library (e.g., Microsoft.ActiveDirectory.Management.dll) which generates the same TypeLib GUIDs flagged as “Red Team” reconnaissance tools.
  • Filter/Exclusion: Create an exclusion for process names ending in .exe launched by powershell.exe or pwsh.exe, specifically when the command line arguments contain -ExecutionPolicy Bypass and run from a known administrative directory (e.g., C:\Scripts\IT_Ops\).

• Enterprise Antivirus Real-Time Scanning

  • Scenario: The endpoint protection agent (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) performs a deep scan of recently modified .NET assemblies. During this scan, the AV engine loads internal C# components to analyze file signatures, inadvertently triggering the detection logic designed for external attack tools.
  • **Filter/