Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that expose unique TypeLibGUID artifacts to evade standard process-based detection. Proactively hunting for these specific identifiers in Azure Sentinel is critical because it enables the SOC team to distinguish legitimate administrative activities from stealthy tool usage often employed during initial reconnaissance or lateral movement phases.

YARA Rule

rule HKTL_NET_GUID_AMSI_Handler {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/two06/AMSI_Handler"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "d829426c-986c-40a4-8ee2-58d14e090ef2" ascii nocase wide
        $typelibguid1 = "86652418-5605-43fd-98b5-859828b072be" ascii nocase wide
        $typelibguid2 = "1043649f-18e1-41c4-ae8d-ac4d9a86c2fc" ascii nocase wide
        $typelibguid3 = "1d920b03-c537-4659-9a8c-09fb1d615e98" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://github.com/two06/AMSI_Handler
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-team tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM or Intune

  • Context: Enterprise deployment agents (e.g., Microsoft Endpoint Configuration Manager or Intune) frequently utilize C#-based executables to install updates, patch applications, or run configuration scripts. These tools often instantiate .NET assemblies that generate typelibguid entries matching known attack surface patterns used by red/blue team tooling.
  • Suggested Filter: Exclude processes where the parent process is ccmexec.exe, Microsoft.Windows.CloudExperienceHost.exe, or IntuneManagementExtension.exe, and the file path resides within the standard system deployment directories (e.g., C:\Program Files\Microsoft Intune Management Extension\).

• Scenario: Scheduled Antivirus Real-Time Scanning

  • Context: Modern endpoint protection suites (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) utilize C# components to perform real-time file system monitoring and heuristic analysis. During scheduled deep scans or signature updates, these agents load specific .NET libraries that trigger the typelibguid detection logic, mimicking the behavior of active reconnaissance tools.
  • Suggested Filter: Create an exclusion for processes with known benign names (e.g., C:\Program Files\CrowdStrike\fs.exe, C:\Program Files\SentinelOne\Sentinel Agent\agent.exe) executing from their default installation directories, specifically filtering out events where the command line contains keywords like “scan,” “update,” or “signature.”

• Scenario: Internal IT Service Management (ITSM) Ticketing Agents

  • Context: Organizations often deploy local agents for ticketing systems (e.g., ServiceNow Agent, J