Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that register unique TypeLib GUIDs to establish persistence or execute reconnaissance within the Azure environment. Proactively hunting for these specific identifiers allows the SOC team to distinguish legitimate administrative activity from potentially malicious tool usage that may evade standard signature-based detection, thereby enhancing visibility into early-stage adversary operations.

YARA Rule

rule HKTL_NET_GUID_CasperStager {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/ustayready/CasperStager"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "c653a9f2-0939-43c8-9b93-fed5e2e4c7e6" ascii nocase wide
        $typelibguid1 = "48dfc55e-6ae5-4a36-abef-14bc09d7510b" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/ustayready/CasperStager
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: CI/CD agents (e.g., Azure DevOps or Jenkins) running on build servers frequently execute C# compilation tasks using the .NET SDK. These processes often instantiate standard COM interfaces that match the typelib GUIDs associated with security tools, triggering alerts during routine builds.
  • Suggested Filter: Exclude process paths containing C:\Program Files\Microsoft Visual Studio, C:\Windows\Microsoft.NET\Framework, or specific build agent service names (e.g., vstest.exe, msbuild.exe) from the detection logic.

• Scenario: Enterprise Endpoint Management Agent Scans

  • Context: Unified Endpoint Management tools like Microsoft Intune, SCCM, or Ivanti often utilize C# components to perform inventory scans and policy updates. These background services frequently load specific typelibs during their scheduled maintenance windows, mimicking the behavior of red-team reconnaissance tools.
  • Suggested Filter: Create an exclusion based on known service names (e.g., ccmexec.exe, IntuneManagementExtension) and restrict the rule to trigger only outside of defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Legitimate Office Add-in Initialization

  • Context: Corporate-wide deployment of Microsoft Office add-ins (such as Adobe Acrobat PDF Maker, DocuSign, or specialized ERP connectors) often involves C# components that register typelibs upon user login or document opening. This initialization can be misidentified as a red-team tool deployment attempting to establish persistence.
  • Suggested Filter: Whitelist specific publisher names (e.g., “Adobe