This hunt targets adversaries leveraging C# Red/Black team tools that generate unique TypeLib GUIDs in the registry to establish persistence or execute custom payloads within Azure Sentinel environments. Proactively hunting for these specific artifacts is critical because their presence often indicates advanced reconnaissance or post-exploitation activities that may evade standard signature-based detections due to their low severity classification and dynamic nature.
rule HKTL_NET_GUID_Csharp_Loader {
meta:
description = "Detects c# red/black-team tools via typelibguid"
reference = "https://github.com/NYAN-x-CAT/Csharp-Loader"
author = "Arnim Rupp"
date = "2020-12-13"
strings:
$typelibguid0 = "5fd7f9fc-0618-4dde-a6a0-9faefe96c8a1" ascii nocase wide
condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the HKTL_NET_GUID detection rule in an enterprise environment, including suggested filters and exclusions:
Scenario: Automated .NET Framework Updates via SCCM/MECM
msiexec.exe process invokes C# components that register TypeLib GUIDs in the registry (HKLM\Software\Classes\TypeLib) as part of the standard installation sequence.C:\Windows\CCM\* or specifically msiexec.exe where the command line contains arguments related to .NET Framework updates (e.g., /qn, ADDLOCAL=All).Scenario: Microsoft Visual Studio Installer Maintenance
Microsoft Visual Studio Installer service runs scheduled maintenance tasks or handles user-initiated component installations. These tasks utilize C# assemblies that dynamically load and register TypeLib GUIDs to manage project templates, extensions, and SDK configurations without any malicious intent.C:\Program Files (x86)\Microsoft Visual Studio\Installer\* or specifically vs_installer.exe, focusing on actions occurring during standard business hours when maintenance windows are active.Scenario: Enterprise Document Management & Conversion Tools