Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that expose unique TypeLibGUID artifacts to evade standard signature-based detection. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because they often indicate early-stage reconnaissance or lateral movement activities that may not trigger high-severity alerts until a compromise has already advanced.

YARA Rule

rule HKTL_NET_GUID_Misc_CSharp {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jnqpblc/Misc-CSharp"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "d1421ba3-c60b-42a0-98f9-92ba4e653f3d" ascii nocase wide
        $typelibguid1 = "2afac0dd-f46f-4f95-8a93-dc17b4f9a3a1" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/jnqpblc/Misc-CSharp
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scheduled Microsoft Defender Antivirus Updates

  • Scenario: The automated Windows Update service or a scheduled task runs MpCmdRun.exe (Microsoft Defender) to perform definition updates. This C# application interacts with the COM library for threat scanning, generating a specific TypelibGUID that matches the rule’s signature for security tools.
  • Filter/Exclusion: Exclude processes where the executable path is C:\Program Files\Windows Defender\MpCmdRun.exe and the parent process is svchost.exe (specifically the wuauserv service).

• Enterprise Endpoint Management Deployments (e.g., Microsoft Intune or SCCM)

  • Scenario: During business hours, a scheduled deployment job runs Microsoft.IntuneManagementAgent.exe or ccmexec.exe. These agents utilize C# libraries to manage software inventory and compliance checks, triggering the detection logic when they enumerate local COM objects.
  • Filter/Exclusion: Create an exclusion for process names containing IntuneManagementAgent, ccmexec, or ConfigurationManager running under the context of a known service account (e.g., NT AUTHORITY\SYSTEM or DOMAIN\AdminService).

• IT Helpdesk Remote Support Sessions

  • Scenario: An IT administrator initiates a remote support session using tools like BeyondTrust, TeamViewer, or LogMeIn. These applications often spawn C# helper processes to manage clipboard sharing and file transfer protocols, which instantiate the targeted TypelibGUID during the connection handshake.
  • Filter/Exclusion: Filter alerts where the parent process is a known remote desktop host (e.g., `