Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies the execution of known C# red and black team tools by analyzing unique TypeLibGUID artifacts, which often indicate active reconnaissance or post-exploitation activities within the environment. Proactively hunting for these signatures in Azure Sentinel is essential to distinguish legitimate security operations from adversarial tooling that may be masquerading as standard administrative tasks.

YARA Rule

rule HKTL_NET_GUID_MultiOS_ReverseShell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/belane/MultiOS_ReverseShell"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "df0dd7a1-9f6b-4b0f-801e-e17e73b0801d" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/belane/MultiOS_ReverseShell
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM or Intune

  • Context: Enterprise Configuration Management tools (e.g., Microsoft Endpoint Configuration Manager or Intune) frequently deploy .NET-based applications to endpoints. These deployments often invoke C# installers that register COM type libraries, generating typelibguid events identical to those used by security testing frameworks.
  • Suggested Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the file path matches the organization’s standard deployment share directory (e.g., C:\Windows\CCMCache\*).

• Scenario: Scheduled Health Check Scripts using PowerShell

  • Context: System administrators often schedule PowerShell scripts to run daily health checks or inventory scans. If these scripts utilize .NET libraries (like System.Runtime.InteropServices) to query system components, they may trigger the rule by registering temporary type libraries during execution.
  • Suggested Filter/Exclusion: Create an exclusion for processes launched by TaskScheduler (svchost.exe -k netsvcs) where the command line contains keywords such as “HealthCheck,” “Inventory,” or specific scheduled task names (e.g., \Microsoft\Windows\Defender Antivirus\*).

• Scenario: Development Environment Build Agents (Jenkins/GitLab CI)

  • Context: In enterprise environments with on-premise build servers, agents running on developer workstations or dedicated build nodes frequently compile C# projects. The build process involves the .NET SDK registering type libraries for various NuGet packages, which can be mistaken for Red/Black team penetration testing tools.

  ---