Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies the execution of C#-based red and black team tools by monitoring for specific TypeLibGUID artifacts often associated with reconnaissance and post-exploitation activities. Proactively hunting for these indicators in Azure Sentinel is critical to distinguish legitimate security testing from potential adversary tooling that mimics standard administrative behavior, ensuring no malicious activity goes unnoticed during routine operations.

YARA Rule

rule HKTL_NET_GUID_HWIDbypass {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/yunseok/HWIDbypass"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "47e08791-d124-4746-bc50-24bd1ee719a6" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters and exclusions:

Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Updates
- Context: The SCCM client service (ccmexec.exe) frequently executes C# components to manage software updates, inventory scans, and compliance checks. These internal tools often utilize standard .NET typelib GUIDs that overlap with those used by Red/Black team reconnaissance utilities (e.g., Microsoft.Windows.Shell.Common).
- Suggested Filter: Exclude processes where the parent process is ccmexec.exe AND the command line contains arguments related to “SoftwareUpdate” or “Inventory”. Additionally, filter out specific known SCCM typelib GUIDs found in your baseline.
Scenario: Automated PowerShell Script Execution via Task Scheduler
- Context: Enterprise IT operations rely heavily on scheduled tasks that invoke powershell.exe to run C#-based management scripts (e.g., user provisioning, license auditing). These scripts often load .NET assemblies with typelib GUIDs identical to those flagged by the rule as “Red Team” artifacts.
- Suggested Filter: Create an exclusion for powershell.exe processes launched directly by Task Scheduler (svchost.exe or taskschd.exe as parent) during standard business hours (08:00–18:00), provided the script path resides in a known administrative folder (e.g., C:\ProgramData\Scripts\Admin).
Scenario: Microsoft Visual Studio and Build Agent Activity
- Context: In development-heavy enterprises, build agents (Azure DevOps Agents or Jenkins) running on developer workstations frequently compile C# code. The compilation process (devenv.exe or `msbuild.exe