Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging custom C# red and black team tools that share specific TypeLibGUID signatures with known NET_GUID malware to blend legitimate activity with malicious tooling. Proactively hunting for these artifacts in Azure Sentinel is critical because low-severity detections of such shared identifiers often indicate early-stage reconnaissance or lateral movement that may be overlooked by standard alert thresholds.

YARA Rule

rule HKTL_NET_GUID_DoHC2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/SpiderLabs/DoHC2"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "9877a948-2142-4094-98de-e0fbb1bc4062" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/SpiderLabs/DoHC2
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the HKTL_NET_GUID_DoHC2 detection rule in an enterprise environment, along with recommended filters or exclusions:

• Automated .NET Framework Updates via WSUS/SCCM

  • Scenario: During scheduled maintenance windows, Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager (MECM/SCCM) pushes updates to the .NET Framework. The update installer (Setup.exe or Microsoft.Update.Client) writes new registry keys containing specific TypeLib GUIDs associated with standard C# runtime components, which mimics the signature of the NET_GUID malware tools.
  • Filter/Exclusion: Create an exclusion based on the parent process name and path. Exclude alerts where the parent process is wsuscontent.exe, ccmexec.exe (SCCM), or WindowsUpdate.exe located in C:\Program Files\Microsoft Update Agent\.

• Enterprise Application Deployment using ClickOnce or MSIX

  • Scenario: IT administrators deploy internal line-of-business applications built on the .NET stack using ClickOnce publish mechanisms or MSIX packaging. The deployment agent (ClickToRun.exe or msiexec.exe) registers TypeLib GUIDs for custom C# libraries (e.g., specific CRM plugins or HR portals) that share structural similarities with the red-team tools defined in the rule.
  • Filter/Exclusion: Filter by the specific registry key path and the SHA-256 hash of the executable performing the registration. Whitelist known internal application hashes and restrict the detection scope to exclude registry writes under HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0\AssemblyFolders for these known deployment agents.

• CI/CD Pipeline Build Agents (Jenkins/GitLab Runner)

  • Scenario: In a DevOps environment, build servers running