Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries are executing C#-based red and black team tools within the environment, identifiable by unique TypeLibGUID artifacts often associated with known security utilities or custom reconnaissance scripts. Proactive hunting for these specific GUIDs in Azure Sentinel is essential to distinguish legitimate operational tooling from covert adversary activity that may be leveraging similar frameworks to establish persistence or conduct lateral movement under a low-severity profile.

YARA Rule

rule HKTL_NET_GUID_hanzoInjection {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/P0cL4bs/hanzoInjection"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "32e22e25-b033-4d98-a0b3-3d2c3850f06c" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/P0cL4bs/hanzoInjection
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Patch Management Deployment

  • Context: Enterprise patch management systems (e.g., Microsoft Endpoint Configuration Manager (MECM) or Ivanti) frequently utilize C# components to deploy updates. These tools often instantiate specific COM libraries during the installation phase, generating typelibguid values that overlap with known Red/Black team tool signatures.
  • Suggested Filter: Exclude events where the parent process is a known patching service (e.g., ccmexec.exe, IvantiAgentService.exe) and the execution path is within the standard system management directories (C:\Program Files\Microsoft Configuration Manager or C:\ProgramData\Ivanti).

• Scenario: Scheduled Code Analysis Scans

  • Context: DevOps teams often run scheduled static code analysis jobs (e.g., SonarQube Scanner, Coverity, or internal CodeQL agents) on build servers. These C#-based scanners load various COM libraries to parse source code, triggering the rule during nightly maintenance windows even though they are legitimate security hygiene tasks.
  • Suggested Filter: Create an exclusion for processes with names containing “Scanner” or “Analysis” running from the C:\BuildAgents or D:\DevTools directories between 02:00 and 06:00 UTC, provided the user context is a dedicated service account (e.g., svc-build-agent).

• Scenario: Endpoint Security Policy Updates

  • Context: Next-generation antivirus and EDR solutions (such as CrowdStrike Falcon, SentinelOne, or Carbon Black) utilize C# modules to push policy updates