Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversary behavior where threat actors utilize C#-based Red and Black team tools that register unique TypeLib GUIDs to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific artifacts in Azure Sentinel is critical because their presence often indicates advanced tooling usage that may bypass standard signature-based detections, requiring manual validation to distinguish between authorized security operations and potential malicious activity.

YARA Rule

rule HKTL_NET_GUID_DLL_Injector {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/tmthrgd/DLL-Injector"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "4581a449-7d20-4c59-8da2-7fd830f1fd5e" ascii nocase wide
        $typelibguid1 = "05f4b238-25ce-40dc-a890-d5bbb8642ee4" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/tmthrgd/DLL-Injector
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects c# red/blue-team tools via typelibguid rule, including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via Microsoft Endpoint Configuration Manager (MECM/SCCM)

  • Context: During scheduled maintenance windows, SCCM agents on Windows workstations execute C#-based deployment packages to install or update enterprise software. These processes often instantiate COM objects with specific typelibguid values associated with the underlying .NET runtime used by the deployment engine.
  • Suggested Filter/Exclusion: Create an exclusion rule for process names matching ccmexec.exe and CcmExec.exe running under the SYSTEM or NT AUTHORITY\NETWORK SERVICE accounts, specifically when the parent process is TSAgent.exe.

• Scenario: Microsoft Office 365 ProPlus Background Updates

  • Context: The background update service for Microsoft Office (often triggered by Group Policy) utilizes C# components to manage add-ins and registry configurations. This frequently generates events containing typelibguid signatures that overlap with those used by security assessment tools, particularly when updating the Outlook or Word COM interfaces.
  • Suggested Filter/Exclusion: Exclude events where the process name is OfficeClickToRun.exe (or Microsoft Office Click-to-Run Service) and the command line contains arguments related to “update” or “scan,” specifically filtering for known Microsoft-signed binaries (Microsoft Corporation).

• Scenario: Enterprise Antivirus Real-Time Scanning Engine

  • Context: Many next-generation antivirus solutions (e.g., CrowdStrike Falcon, Symantec Endpoint Protection, or McAfee) utilize C# modules to hook into the OS file system. When these engines scan large directories containing .NET assemblies, they may trigger the detection logic by loading specific type libraries that