Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries executing specialized C# red and black team tools by identifying unique TypeLibGUID artifacts often used to evade standard process monitoring. Proactively hunting for these signatures in Azure Sentinel is critical because it enables security teams to distinguish legitimate internal testing activities from potential adversary reconnaissance or tool deployment that mimics benign operations.

YARA Rule

rule HKTL_NET_GUID_OffensivePowerShellTasking {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/leechristensen/OffensivePowerShellTasking"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "d432c332-3b48-4d06-bedb-462e264e6688" ascii nocase wide
        $typelibguid1 = "5796276f-1c7a-4d7b-a089-550a8c19d0e8" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/leechristensen/OffensivePowerShellTasking
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects c# red/blue-team tools via typelibguid rule, including suggested filters and exclusions:

• Automated Patch Management Deployments

  • Scenario: Enterprise patch management solutions like Microsoft Endpoint Configuration Manager (SCCM) or Ivanti utilize C# agents to deploy updates. During scheduled maintenance windows, these agents instantiate specific COM libraries to communicate with the OS, triggering the typelibguid detection for known tool signatures even though no security testing is occurring.
  • Suggested Filter: Exclude processes running under the context of specific service accounts (e.g., NT SERVICE\CCMExec) or restrict the rule to only trigger outside of defined maintenance windows (e.g., 02:00–06:00 UTC).

• CI/CD Pipeline Build Agents

  • Scenario: In a DevOps environment, build servers such as Azure DevOps, Jenkins, or GitLab Runners execute C# compilation and testing tasks. These agents often load standard .NET libraries that share typelibguid values with Red/Blue team reconnaissance tools (e.g., mimicking the GUIDs used by tools like BloodHound or SharpUp) during routine code builds.
  • Suggested Filter: Create an exclusion for known build server hostnames and specific process paths (e.g., C:\Program Files\Azure DevOps Agent\), ensuring that only user-initiated tool execution on endpoint workstations triggers the alert.

• Enterprise Antivirus Heuristic Scans

  • Scenario: Modern EDR/Antivirus solutions like CrowdStrike, SentinelOne, or Carbon Black perform deep heuristic scans using C# components to analyze file integrity and memory structures. These internal scanning modules often register the