Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies the execution of C#-based Red and Blue team utilities by analyzing unique TypeLibGUID signatures often associated with security testing frameworks or reconnaissance activities. Proactively hunting for these indicators in Azure Sentinel allows the SOC to distinguish between legitimate internal tooling and potential adversary use of similar C# artifacts, ensuring that stealthy threat actors leveraging standard development environments are not overlooked during routine operations.

YARA Rule

rule HKTL_NET_GUID_iSpyKeylogger {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/mwsrc/iSpyKeylogger"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "ccc0a386-c4ce-42ef-aaea-b2af7eff4ad8" ascii nocase wide
        $typelibguid1 = "816b8b90-2975-46d3-aac9-3c45b26437fa" ascii nocase wide
        $typelibguid2 = "279b5533-d3ac-438f-ba89-3fe9de2da263" ascii nocase wide
        $typelibguid3 = "88d3dc02-2853-4bf0-b6dc-ad31f5135d26" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://github.com/mwsrc/iSpyKeylogger
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Jenkins or Azure DevOps agents running C# build tasks (e.g., MSBuild, NUnit) on build servers often instantiate COM objects that match the typelibguid signatures of security tools. These are routine infrastructure activities, not adversarial tool usage.
  • Filter/Exclusion: Create a process exclusion for known CI/CD service accounts and hostnames (e.g., exclude processes running under SYSTEM or specific build agent user accounts on hosts matching the regex ^BUILD-AGENT-[0-9]+$).

• Scenario: Microsoft Defender Antivirus Real-Time Scanning

  • Context: The Microsoft Defender Antivirus service (MsMpEng.exe) frequently loads C# components for its real-time protection engine, which may generate the specific TypeLib GUIDs associated with Red/Blue team tools during routine file system monitoring.
  • Filter/Exclusion: Add a process exclusion specifically for MsMpEng.exe to ignore events where the parent process is the Defender service, as this is native behavior rather than a deployed security tool.

• Scenario: Scheduled PowerShell Health Checks

  • Context: IT Operations teams often schedule nightly PowerShell scripts (powershell.exe) to query system health or inventory software versions using C# libraries. These scripts may invoke COM interfaces that trigger the detection logic.
  • Filter/Exclusion: Implement a time-based filter combined with command line analysis; exclude events occurring between 02:00 and 04:00 where the parent process is Task Scheduler (svchost.exe -k netsvcs) and the command line contains keywords like “health-check