Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies the execution of specialized C# red and black team tools by analyzing unique TypeLibGUID signatures to distinguish legitimate security operations from potential adversary activity. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to validate authorized tool usage while rapidly detecting unauthorized or anomalous deployment of similar utilities that could signal early-stage reconnaissance or lateral movement attempts.

YARA Rule

rule HKTL_NET_GUID_Net_GPPPassword {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/outflanknl/Net-GPPPassword"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "00fcf72c-d148-4dd0-9ca4-0181c4bd55c3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

Scenario: Microsoft Office Click-to-Run Updates
- Context: The Office Click-to-Run service (OfficeClickToRun.exe) frequently registers COM components with specific TypelibGUIDs that match the signatures of C# security tools. This often triggers during scheduled update cycles or when a user opens an Office application for the first time after a patch.
- Filter/Exclusion: Exclude processes where the ImageName is OfficeClickToRun.exe and the parent process is OfficeC2RClient.exe. Alternatively, filter out events where the TypelibGUID belongs to known Microsoft Office namespaces (e.g., starting with {000...}).
Scenario: Visual Studio Build & Deployment Tasks
- Context: During routine CI/CD pipelines or developer workstations running MSBuild tasks (MSBuild.exe) and Visual Studio instances (devenv.exe), the system loads C# assemblies that instantiate COM type libraries. These tools often utilize standard .NET Framework GUIDs identical to those used by red-team simulation frameworks (like Covenant or Invoke-WebRequest wrappers).
- Filter/Exclusion: Create an exclusion for processes running under the C:\Program Files\Microsoft Visual Studio directory path. Additionally, exclude events where the parent process is VSTT.exe (Visual Studio Team Services) or MSBuild.exe.
Scenario: Scheduled PowerShell Reporting Jobs
- Context: Enterprise environments often run scheduled PowerShell jobs (powershell.exe) that generate compliance reports using C# libraries. These scripts frequently instantiate .NET objects with specific TypeLibGUIDs that mimic the footprint of black-team analysis tools (e.g., tools like SharpChroot or