Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that expose unique TypeLibGUID artifacts to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel is critical because their low-severity nature often allows them to evade standard alerting thresholds, enabling attackers to maintain a stealthy foothold before escalating their activities.

YARA Rule

rule HKTL_NET_GUID_Browser_ExternalC2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/mdsecactivebreach/Browser-ExternalC2"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "10a730cd-9517-42d5-b3e3-a2383515cca9" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects c# red/blue-team tools via typelibguid rule, including suggested filters and exclusions:

Scenario: Automated Build Pipeline Execution
- Context: CI/CD pipelines (e.g., Jenkins, Azure DevOps) frequently utilize C#-based build agents or custom PowerShell modules that instantiate .NET assemblies containing standard Red Team tool GUIDs during the compilation of internal applications. These are legitimate development activities occurring on build servers rather than security incidents.
- Suggested Filter/Exclusion: Exclude hostnames matching *-build-server or process paths located within the CI/CD agent directory (e.g., C:\Program Files\Jenkins\agents\*) where the parent process is the build orchestrator (e.g., java.exe, agent.exe).
Scenario: Endpoint Protection Scanning
- Context: Enterprise EDR agents (such as CrowdStrike, SentinelOne, or Carbon Black) often perform deep heuristic scans that load C# libraries to analyze file integrity. These scanners may trigger the rule by loading a shared typelib GUID associated with common Red Team frameworks (like Cobalt Strike’s Beacon or Mythic) while scanning for known malware signatures on user endpoints.
- Suggested Filter/Exclusion: Create an exclusion for processes owned by the EDR vendor (e.g., csagent.exe, s1service.exe) and filter events where the process command line contains arguments related to “scan,” “update,” or “heuristic” checks.
Scenario: Scheduled Software Deployment Tasks
- Context: IT Operations teams use deployment tools like SCCM (Microsoft Configuration Manager) or Ansible Tower to push updates. These tools often invoke C# scripts that reference standard .NET typelibs used by security assessment suites to verify the integrity of deployed binaries