Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that can be uniquely identified through their specific TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate security operations and potential adversary activity, ensuring early detection of tool usage that might otherwise blend into routine administrative noise.

YARA Rule

rule HKTL_NET_GUID_C_Sharp_R_A_T_Client {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/AdvancedHacker101/C-Sharp-R.A.T-Client"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "6d9e8852-e86c-4e36-9cb4-b3c3853ed6b8" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” including suggested filters and exclusions:

Scenario: Microsoft Office Application Updates
- Context: The OfficeClickToRun.exe or Update.exe processes frequently instantiate C# assemblies that register specific TypeLibGUIDs during background update checks or feature installation. These GUIDs often overlap with those used by security tools like Microsoft Defender for Endpoint or Sysinternals Suite.
- Suggested Filter/Exclusion: Exclude the process OfficeClickToRun.exe and Update.exe running from the path C:\Program Files\Microsoft Office\root\Office16\. Additionally, filter out TypeLibGUIDs belonging to known Microsoft Office namespaces (e.g., starting with {0002...}).
Scenario: Scheduled PowerShell Automation Scripts
- Context: Enterprise IT teams often deploy scheduled tasks that utilize C# libraries for reporting or inventory management. A common example is a nightly script using the Quest ActiveRoles Management Shell or custom scripts leveraging Pester (a testing framework) which generates TypeLibGUIDs when compiling dynamic modules.
- Suggested Filter/Exclusion: Create an exclusion based on the parent process TaskHost.exe or svchost.exe where the command line contains specific keywords like “InventoryReport” or “Pester”. Alternatively, exclude TypeLibGUIDs associated with the .NET Framework version 4.8 if they are not part of your red-team toolset.
Scenario: Visual Studio Build and Deployment Agents
- Context: In development environments, Azure DevOps Agents or Jenkins Nodes running on Windows servers execute build pipelines that compile C# code. These agents often load the Microsoft.Build.Engine assemblies which register