Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis detects adversaries leveraging custom C# Red or Black team tools by identifying unique typelib GUID signatures often associated with specialized security utilities within Azure Sentinel environments. Proactive hunting for these specific identifiers is essential to distinguish legitimate operational tooling from potential adversary activity that mimics standard administrative processes, thereby reducing false positives and uncovering stealthy reconnaissance efforts.

YARA Rule

rule HKTL_NET_GUID_Nuages {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/p3nt4/Nuages"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "e9e80ac7-4c13-45bd-9bde-ca89aadf1294" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/p3nt4/Nuages
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated Microsoft Office Deployment & Configuration

  • Context: The rule triggers when the msiexec or OfficeSetup.exe processes invoke C# libraries to install or update Office 365 components. These installations often load specific TypeLib GUIDs associated with COM add-ins (e.g., Outlook, Excel) that overlap with Red Team tool signatures.
  • Filter/Exclusion: Exclude process paths containing C:\Program Files\Microsoft Office* and C:\Program Files (x86)\Microsoft Office*. Additionally, filter out events where the parent process is msiexec.exe running under the SYSTEM or a known deployment service account.

• Scenario: Scheduled Antivirus Database Updates

  • Context: Enterprise Endpoint Detection and Response (EDR) agents (such as Microsoft Defender for Endpoint or CrowdStrike Falcon) perform scheduled scans that load C# modules for heuristic analysis. These modules frequently register TypeLib GUIDs used by security automation tools, causing the rule to flag routine update cycles as potential Red Team tool usage.
  • Filter/Exclusion: Create an exclusion list for known EDR service executables (e.g., MsMpEng.exe, C-Service.exe) and their child processes. Filter events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the parent process is identified as a scheduled task (Task Scheduler).

• Scenario: Internal IT Management & Reporting Dashboards

  • Context: Custom internal C# applications used by the Helpdesk or IT Operations team (e.g., asset management tools, ticketing system agents like ServiceNow or J