Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies the execution of known C# red and black team tools by analyzing unique TypeLibGUID signatures to distinguish legitimate security activities from potential adversary tool usage. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to validate authorized testing operations while rapidly detecting unauthorized or anomalous deployment of similar offensive and defensive utilities that could signal early-stage reconnaissance or lateral movement.

YARA Rule

rule HKTL_NET_GUID_Altman {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/keepwn/Altman"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "64cdcd2b-7356-4079-af78-e22210e66154" ascii nocase wide
        $typelibguid1 = "f1dee29d-ca98-46ea-9d13-93ae1fda96e1" ascii nocase wide
        $typelibguid2 = "33568320-56e8-4abb-83f8-548e8d6adac2" ascii nocase wide
        $typelibguid3 = "470ec930-70a3-4d71-b4ff-860fcb900e85" ascii nocase wide
        $typelibguid4 = "9514574d-6819-44f2-affa-6158ac1143b3" ascii nocase wide
        $typelibguid5 = "0f3a9c4f-0b11-4373-a0a6-3a6de814e891" ascii nocase wide
        $typelibguid6 = "9624b72e-9702-4d78-995b-164254328151" ascii nocase wide
        $typelibguid7 = "faae59a8-55fc-48b1-a9b5-b1759c9c1010" ascii nocase wide
        $typelibguid8 = "37af4988-f6f2-4f0c-aa2b-5b24f7ed3bf3" ascii nocase wide
        $typelibguid9 = "c82aa2fe-3332-441f-965e-6b653e088abf" ascii nocase wide
        $typelibguid10 = "6e531f6c-2c89-447f-8464-aaa96dbcdfff" ascii nocase wide
        $typelibguid11 = "231987a1-ea32-4087-8963-2322338f16f6" ascii nocase wide
        $typelibguid12 = "7da0d93a-a0ae-41a5-9389-42eff85bb064" ascii nocase wide
        $typelibguid13 = "a729f9cc-edc2-4785-9a7d-7b81bb12484c" ascii nocase wide
        $typelibguid14 = "55a1fd43-d23e-4d72-aadb-bbd1340a6913" ascii nocase wide
        $typelibguid15 = "d43f240d-e7f5-43c5-9b51-d156dc7ea221" ascii nocase wide
        $typelibguid16 = "c2e6c1a0-93b1-4bbc-98e6-8e2b3145db8e" ascii nocase wide
        $typelibguid17 = "714ae6f3-0d03-4023-b753-fed6a31d95c7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 18 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” along with suggested filters and exclusions:

Scenario: Automated Build Pipeline Execution
- Context: Continuous Integration/Continuous Deployment (CI/CD) agents (e.g., Jenkins, Azure DevOps, GitHub Actions) running on build servers often utilize C#-based .NET SDKs to compile code or run unit tests. These processes frequently instantiate COM objects that match the typelibguid signatures of common security tools like Falcon, Cobalt Strike, or BloodHound.
- Suggested Filter/Exclusion: Create an exclusion based on the Process Name and User Account. Exclude events where the process name matches known CI agents (e.g., dotnet.exe, msbuild.exe, VSTestPlatform) running under service accounts such as NT SERVICE\Jenkins or AZURE-DEVOPS-BUILD-SVC.
Scenario: Scheduled Endpoint Security Scans
- Context: Enterprise Endpoint Detection and Response (EDR) solutions often include scheduled C# modules that perform deep system introspection. For instance, a nightly scan by CrowdStrike Falcon or SentinelOne might load specific COM libraries to analyze memory structures, triggering the rule’s detection logic even though it is an internal security function rather than an external Red Team activity.
- Suggested Filter/Exclusion: Implement a filter excluding events where the Parent Process Name is the primary EDR agent (e.g., FalconSensorService.exe, SentinelOneAgent.exe) and the event occurs during predefined maintenance windows (e.g., 02:00 – 04:00 UTC).
**Scenario: Office 365 / Microsoft Teams Background