Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based offensive and defensive tools that register unique TypeLib GUIDs to establish a foothold or conduct reconnaissance within the environment. Proactive hunting for these specific artifacts in Azure Sentinel is essential because such tools often operate with low visibility, allowing attackers to execute custom payloads or maintain persistence without triggering standard signature-based alerts.

YARA Rule

rule HKTL_NET_GUID_Grouper2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/l0ss/Grouper2/"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "5decaea3-2610-4065-99dc-65b9b4ba6ccd" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/l0ss/Grouper2/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” including suggested filters or exclusions:

• Scenario: Automated Patch Management Execution

  • Context: Enterprise patching solutions like Microsoft System Center Configuration Manager (SCCM) or Ansible Tower often utilize C# agents to deploy updates. These agents frequently instantiate COM objects with specific typelibguid values during the installation phase, mimicking the behavior of Red Team tools like Cobalt Strike Beacon.
  • Filter/Exclusion: Create an exclusion for processes running under the service account (e.g., NT SERVICE\CCMService) or whitelist the specific typelibguid associated with the patching agent’s COM interface.

• Scenario: Scheduled Backup and Reporting Jobs

  • Context: Internal reporting tools built on .NET Framework (such as custom Power BI refresh scripts or Veeam Backup & Replication agents) often generate C# assemblies that register type libraries during nightly scheduled tasks. These jobs may trigger the rule when they initialize data connectors.
  • Filter/Exclusion: Exclude alerts where the process path matches known backup/reporting directories (e.g., C:\Program Files\Veeam\Backup and Replication\...) or filter by time windows corresponding to maintenance schedules (e.g., 02:00–04:00).

• Scenario: Endpoint Detection and Response (EDR) Self-Scanning

  • Context: EDR solutions like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint utilize C# components to perform self-diagnostic scans or policy updates. These internal tools often load type libraries that overlap with the typelibguid signatures of Black Team reconnaissance tools (e.g., **BloodHound