Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies potential adversary activity by detecting C# Red and Black team tools through unique TypelibGUID signatures within Azure Sentinel logs. Proactively hunting for these specific tool identifiers allows the SOC team to distinguish between legitimate security operations and malicious reconnaissance or post-exploitation activities that may otherwise blend into normal background noise.

YARA Rule

rule HKTL_NET_GUID_BrowserPass {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jabiel/BrowserPass"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "3cb59871-0dce-453b-857a-2d1e515b0b66" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/jabiel/BrowserPass
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated Deployment of Microsoft Teams or Office 365 ProPlus updates.

  • Context: The Microsoft.Update.Client service or background update agents utilize C# assemblies with specific TypeLib GUIDs that overlap with common Red Team tools (e.g., Mimikatz or SharpUp) during the installation phase.
  • Filter/Exclusion: Exclude processes where the executable path contains \Program Files\Microsoft Office\root\Office16\ or \Teams\, and filter out events where the parent process is msiexec.exe or dcomcnfg.exe.

• Scenario: Scheduled PowerShell Health Checks via System Center Configuration Manager (SCCM).

  • Context: SCCM clients run scheduled maintenance tasks using C#-based PowerShell scripts to query system health. These scripts often instantiate COM objects that generate TypeLib GUIDs identical to those used by Black Team monitoring tools like SharpHunt or Bloodhound.
  • Filter/Exclusion: Create a rule exclusion for events where the command line contains arguments related to “HealthCheck” or “Inventory,” and restrict the scope to specific SCCM client IDs (e.g., CCMExec.exe) running under the SYSTEM account.

• Scenario: Execution of Internal .NET-Based Reporting Tools (e.g., Tableau Server Agents).

  • Context: Enterprise reporting agents (such as Tableau Server or Power BI Gateway) run background C# services that load specific TypeLib GUIDs for data extraction, which can mimic the signature of Red Team tools like SharpView or Rubeus.
  • Filter/Exclusion: Exclude processes with executable names containing “Tableau”, ”