Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate security testing operations and malicious reconnaissance or lateral movement attempts that leverage similar tooling patterns.

YARA Rule

rule HKTL_NET_GUID_Inferno {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/LimerBoy/Inferno"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "26d498f7-37ae-476c-97b0-3761e3a919f0" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/LimerBoy/Inferno
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Automated Deployment of Microsoft Visual Studio Tools (MSBuild)

  • Context: During nightly CI/CD pipelines, the build server executes msbuild.exe or devenv.exe to compile .NET solutions. These tools dynamically load C# assemblies that register specific TypeLibGUIDs often associated with Red Team automation frameworks.
  • Filter/Exclusion: Exclude processes running under the account NT SERVICE\TeamFoundationBuildAgent (or your specific CI service account) where the parent process is vstest.console.exe or msbuild.exe. Additionally, filter by the specific TypeLibGUIDs known to be part of the standard Visual Studio SDK.

• Scenario: Scheduled Antivirus Engine Updates

  • Context: Enterprise Endpoint Protection (e.g., Microsoft Defender for Endpoint) performs scheduled signature updates using C# based management agents. These agents utilize COM interfaces with TypeLibGUIDs that overlap with those used by common Red Team tools like SharpUp or BloodHound.
  • Filter/Exclusion: Create an exclusion for the process name MsMpEng.exe (Microsoft Defender) and SenseAgent.exe when the event source is “Scheduled Task” rather than interactive user login. Filter specifically on the TypeLibGUIDs registered by the antivirus vendor’s update engine.

• Scenario: Execution of Microsoft Office Add-ins

  • Context: Users launching Excel or Outlook with heavy C# based add-ins (e.g., Power BI Desktop integration, custom ERP connectors) trigger COM registration events. These add-ins often share TypeLibGUIDs with Black Team monitoring tools like Sysmon extensions or PowerShell module loaders.
  • Filter/Exclusion: Exclude events where the parent