Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies the execution of known C# red and black team tools by monitoring for specific TypeLibGUID artifacts often used during security assessments or post-exploitation activities. Proactively hunting for these indicators in Azure Sentinel allows the SOC to distinguish between authorized testing operations and potential adversary reconnaissance, ensuring that legitimate tool usage is not mistaken for anomalous behavior while maintaining visibility into active engagement within the environment.

YARA Rule

rule HKTL_NET_GUID_Marauder {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/maraudershell/Marauder"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "fff0a9a3-dfd4-402b-a251-6046d765ad78" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/maraudershell/Marauder
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters or exclusions:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, frequently utilize C# components to download and install virus definition updates. These processes often instantiate specific TypeLib GUIDs associated with the vendor’s update engine during early morning scheduled maintenance windows.
  • Filter/Exclusion: Create a whitelist rule excluding events where the ProcessName matches known EDR service executables (e.g., C:\Program Files\CrowdStrike\fsa.exe) and the CommandLine contains keywords like “update”, “scan”, or “definition”. Additionally, exclude TypeLib GUIDs belonging to major security vendors.

• Scenario: Microsoft Office 365 ProPlus Background Tasks

  • Context: The Microsoft Office Click-to-Run Service (OfficeC2RClient.exe) and the Microsoft Office File Viewer often spawn C# background tasks for license validation, feature updates, or OneDrive synchronization. These legitimate activities trigger TypeLib GUIDs registered by Microsoft that overlap with those used by Red/Blue team reconnaissance tools.
  • Filter/Exclusion: Exclude events originating from the C:\Program Files\Microsoft Office directory path where the parent process is OfficeClickToRun.exe. Specifically, filter out TypeLib GUIDs associated with known Microsoft Office automation libraries (e.g., those starting with 0002...).

• Scenario: Internal IT Asset Management Scans

  • Context: Organizations often deploy internal inventory tools like LanDesk, ManageEngine Desktop Central, or custom PowerShell/C# scripts to scan hardware and software assets