Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that expose unique typelibguid identifiers to establish persistence or execute reconnaissance within Azure environments. Proactively hunting for these specific GUIDs allows the SOC team to distinguish legitimate security tooling from malicious C# payloads, thereby reducing alert fatigue while identifying early-stage lateral movement or command-and-control activities.

YARA Rule

rule HKTL_NET_GUID_AmsiScanBufferBypass {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/AmsiScanBufferBypass"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "431ef2d9-5cca-41d3-87ba-c7f5e4582dd2" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/rasta-mouse/AmsiScanBufferBypass
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid” in an enterprise environment, along with suggested filters:

• Automated .NET Build and Deployment Pipelines

  • Scenario: CI/CD agents (e.g., Azure DevOps Agents or Jenkins running on Windows) frequently execute C# build tasks using MSBuild.exe or dotnet.exe. These tools load standard Microsoft type libraries to compile code, run unit tests, or package applications, triggering the typelibguid signature associated with development tooling.
  • Suggested Filter: Exclude processes running under specific service accounts (e.g., NT SERVICE\BuildAgent, SYSTEM) located in known build directories such as C:\Program Files\Microsoft Visual Studio\... or C:\Jenkins\workspace\.

• Enterprise Antivirus and Endpoint Protection Scans

  • Scenario: Major endpoint protection suites (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon, or Symantec) utilize C# components to perform real-time scanning and heuristic analysis. These agents often load type libraries to inspect .NET assemblies on disk or in memory, mimicking the behavior of red/blue team enumeration tools.
  • Suggested Filter: Create an exclusion for known antivirus process names (e.g., MsMpEng.exe, CfSvc.exe, Symantec Endpoint Protection) and restrict the rule to only trigger if the parent process is not a security service.

• Scheduled Group Policy and Configuration Management Tasks

  • Scenario: Scheduled tasks managed by tools like Microsoft SCCM (Configuration Manager), Ansible, or PowerShell DSC run nightly compliance checks. These jobs often invoke C# scripts that query WMI or registry keys using standard type libraries to verify software inventory or configuration states against baseline policies.