Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries executing C#-based red or black team reconnaissance tools by identifying unique TypeLibGUID artifacts often overlooked in standard logging. Proactively hunting for these indicators within Azure Sentinel is critical to distinguish legitimate security testing from potential lateral movement or early-stage malware activity that mimics benign tooling behavior.

YARA Rule

rule HKTL_NET_GUID_Carbuncle {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/checkymander/Carbuncle"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "3f239b73-88ae-413b-b8c8-c01a35a0d92e" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/checkymander/Carbuncle
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, tailored for an enterprise environment:

• Automated Patch Management Deployments (Microsoft Endpoint Configuration Manager / SCCM)

  • Scenario: The SCCM agent (ccmexec.exe) frequently invokes C#-based deployment scripts or custom extensions to install security updates. These processes often load specific TypeLib GUIDs associated with internal management tools that mimic the signature of Red/Blue team reconnaissance utilities, particularly when scanning for compliance or inventory collection.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmexec.exe and the command line contains keywords like /package, /install, or specific SCCM site codes (e.g., SITENAME=ABC).

• Scheduled Office 365 Compliance & Data Loss Prevention Scans

  • Scenario: Scheduled background jobs running the Microsoft Purview compliance engine utilize C# components to scan local file shares and mailboxes for data classification. These scans trigger TypeLib GUIDs that overlap with threat hunting tools, as both rely heavily on .NET reflection APIs to inspect document metadata in real-time.
  • Filter/Exclusion: Create an exclusion rule for processes named Microsoft.Compliance.Engine.exe or OneDriveStandaloneUpdater.exe running during off-peak maintenance windows (e.g., 02:00–04:00 local time) with a known user context of SYSTEM or a dedicated service account.

• Enterprise Antivirus Real-Time Protection Scans (CrowdStrike / SentinelOne)

  • Scenario: Modern EDR agents often inject C# modules to perform deep behavioral analysis on running applications. When these agents scan .NET frameworks or specific enterprise line-of-business applications, they instantiate TypeLib GUIDs that are identical to