Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLibGUIDs to establish persistence or execute reconnaissance within the Azure environment. Proactively hunting for these specific identifiers in Azure Sentinel allows the SOC team to distinguish legitimate tooling from malicious activity, ensuring early detection of known security frameworks before they escalate into higher-severity incidents.

YARA Rule

rule HKTL_NET_GUID_Disable_Windows_Defender {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/Disable-Windows-Defender"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "501e3fdc-575d-492e-90bc-703fb6280ee2" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid” in an enterprise environment, along with suggested filters:

Scenario: Automated Patch Management Deployment
- Context: Enterprise patch management solutions (e.g., Microsoft SCCM/MECM, Ivanti Endpoint Manager, or ManageEngine) utilize C# agents to scan system libraries and install updates. These agents frequently instantiate .NET assemblies containing specific typelibguid values associated with Red Team simulation frameworks during their background health checks, even when no active attack is occurring.
- Suggested Filter: Exclude processes running under the context of known patch management service accounts (e.g., NT SERVICE\ccmexec, IvantiAgent) and restrict alerts to specific parent process paths like C:\Program Files\Microsoft Configuration Manager\ or C:\Program Files (x86)\Ivanti\.
Scenario: Scheduled Antivirus Deep Scan
- Context: Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon, SentinelOne, or Carbon Black, perform scheduled deep scans that involve loading various C# helper libraries. During these scans, the EDR engine may load a typelibguid used by internal Red Team tooling to verify file integrity, triggering the rule despite being a routine maintenance task.
- Suggested Filter: Create an exclusion for the specific EDR sensor process names (e.g., csagent.exe, s1service.exe) and filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where these deep scans are historically scheduled.
Scenario: Office 365 / Microsoft Teams Background Updates
- Context: The **Microsoft Office Click