Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt identifies adversary activity involving C#-based red and black team tools by analyzing unique TypeLibGUID artifacts often used to evade standard signature-based detection. Proactively hunting for these specific GUIDs in Azure Sentinel allows the SOC team to distinguish between legitimate security operations and potential lateral movement or reconnaissance activities that may otherwise remain invisible due to their low severity classification.

YARA Rule

rule HKTL_NET_GUID_IIS_backdoor {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/WBGlIl/IIS_backdoor"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "3fda4aa9-6fc1-473f-9048-7edc058c4f65" ascii nocase wide
        $typelibguid1 = "73ca4159-5d13-4a27-8965-d50c41ab203c" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/WBGlIl/IIS_backdoor
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-team tools via TypelibGUID rule, including suggested filters and exclusions:

• Microsoft Office Click-to-Run Updates

  • Scenario: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) frequently executes background tasks to update or repair Office components. These processes often load C# assemblies that generate specific TypelibGUID values associated with standard .NET interop libraries, which the rule may misinterpret as active Red/Black team reconnaissance tools.
  • Filter/Exclusion: Exclude process paths containing \Microsoft Office\root\Office*\* and specifically filter out TypelibGUIDs known to belong to Microsoft Office Interop (e.g., 000209FF-0000-0000-C000-000000000046).

• Visual Studio Deployment & Build Agents

  • Scenario: In enterprises with internal development teams, Azure DevOps or Jenkins agents running on build servers execute devenv.exe or MSBuild.exe. These tools heavily utilize C# libraries for compiling code and deploying applications, generating TypelibGUID signatures that closely match those used by security testing frameworks.
  • Filter/Exclusion: Create an exclusion list for process names including devenv.exe, MSBuild.exe, and dotnet.exe located within the build agent directories (e.g., C:\Program Files\Microsoft Visual Studio\* or D:\Jenkins\workspace\*).

• Scheduled System Health Diagnostics

  • Scenario: Enterprise IT operations often run scheduled PowerShell scripts (powershell.exe) wrapped in C# wrappers to perform system health checks, inventory collection, and patch compliance reporting. These jobs load