Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging custom C# tools with unique TypeLibGUID signatures to establish persistence or execute reconnaissance within the environment. Proactive hunting for these specific GUIDs in Azure Sentinel is essential to identify stealthy red and black team activities that may evade standard signature-based detections due to their low severity classification.

YARA Rule

rule HKTL_NET_GUID_EWSToolkit {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/EWSToolkit"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "ca536d67-53c9-43b5-8bc8-9a05fdc567ed" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

Scenario: Automated Patch Management Execution
- Context: Enterprise patch management systems like Microsoft Endpoint Configuration Manager (SCCM) or Ivanti often utilize C# agents to scan system components. These agents frequently instantiate COM objects with specific TypelibGUIDs that match the signature of Red/Blue team reconnaissance tools, triggering alerts during scheduled maintenance windows.
- Filter/Exclusion: Create a whitelist exclusion for the process image path (e.g., C:\Program Files\Microsoft Configuration Manager\...) and restrict detection to non-business hours or exclude specific user accounts known as “System” or “Local Service”.
Scenario: Internal DevOps Build Pipelines
- Context: CI/CD platforms such as Azure DevOps Agents, Jenkins, or internal custom build runners often execute C# compilation tasks on build servers. These agents load standard .NET assemblies and COM libraries that share the same TypelibGUID footprint as security testing tools, causing alerts during nightly builds or PR merges.
- Filter/Exclusion: Exclude processes running under specific service accounts (e.g., DEVOPS-BUILD-SVC) or filter based on the parent process name being a known CI runner executable (e.g., msbuild.exe, dotnet.exe).
Scenario: Enterprise Document Management & OCR Services
- Context: Legacy document management systems like SharePoint Server, Kofax, or ABBYY FineReader utilize C# components to process documents via COM interop. The background services for these tools often register typelibs that collide with the detection logic, generating alerts when users upload large batches of files or run