Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis posits that adversaries are leveraging C#-based red and black team tools identifiable by unique typelibguid values to establish persistence or conduct reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel is critical because low-severity alerts may be overlooked, allowing attackers to operate undetected before escalating their activities to more impactful stages of the kill chain.

YARA Rule

rule HKTL_NET_GUID_BrowserGhost {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/QAX-A-Team/BrowserGhost"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "2133c634-4139-466e-8983-9a23ec99e01b" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/QAX-A-Team/BrowserGhost
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid” in an enterprise environment, along with suggested filters:

• Automated Patch Management Deployment

  • Scenario: The organization uses a centralized patch management solution (e.g., Microsoft SCCM/MECM, Ivanti, or ManageEngine) that utilizes C# agents to query the local registry for software inventory. During scheduled maintenance windows, these agents enumerate installed applications by reading typelibguid values in the HKEY_CLASSES_ROOT\TypeLib and TypeLibs keys to verify .NET assembly versions before applying updates.
  • Suggested Filter: Exclude processes running under the specific service account (e.g., NT SERVICE\SCCMAgent) or whitelist known patch management executable paths (e.g., C:\Program Files\Microsoft Configuration Manager\bin\ccmexec.exe).

• Enterprise Endpoint Protection Scans

  • Scenario: Next-generation antivirus and EDR solutions (such as CrowdStrike Falcon, SentinelOne, or Carbon Black) perform deep file system scans. Their C# scanning engines frequently access typelibguid entries to analyze the integrity of .NET-based applications and detect potential anomalies in registered COM components, triggering the rule during routine background scans without any malicious intent.
  • Suggested Filter: Create an exclusion for known EDR sensor processes (e.g., C:\Program Files\CrowdStrike\fs.exe) or filter out events where the parent process is the OS security service (SecurityHealthService).

• Scheduled Software Inventory Audits

  • Scenario: A third-party IT Asset Management tool (like Lansweeper, SolarWinds NCM, or custom PowerShell/C# scripts) runs on a nightly schedule to audit software compliance. These