Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity involving C# Red and Black team tools by analyzing unique TypeLibGUID artifacts often left during reconnaissance or post-exploitation phases. Proactively hunting for these signatures in Azure Sentinel is essential to distinguish legitimate security operations from malicious tool usage that may otherwise evade standard signature-based defenses due to their low severity classification.

YARA Rule

rule HKTL_NET_GUID_OSSFileTool {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/B1eed/OSSFileTool"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "207aca5d-dcd6-41fb-8465-58b39efcde8b" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/B1eed/OSSFileTool
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM or Intune

  • Context: Enterprise deployment agents (such as Microsoft Endpoint Configuration Manager or Microsoft Intune) frequently utilize C# scripts to install updates or manage configurations. These scripts often load specific .NET assemblies containing unique TypelibGUIDs that match the signatures of red/black team reconnaissance tools, even though they are performing standard patching tasks.
  • Suggested Filter: Exclude processes originating from known deployment service accounts (e.g., NT SERVICE\ccmexec, SYSTEM) running under specific parent process names like ccmsetup.exe or Microsoft.IntuneManagementAgent.

• Scenario: Scheduled PowerShell Health Checks

  • Context: IT Operations teams often schedule recurring PowerShell jobs to check server health, disk usage, or service status. These scripts frequently invoke C# libraries (e.g., for WMI interaction or specific monitoring SDKs) that generate TypelibGUID entries identical to those used by internal penetration testing frameworks.
  • Suggested Filter: Create an exclusion for processes launched by the Task Scheduler (svchost.exe -k netsvcs) with a command line containing keywords like -ExecutionPolicy Bypass, -File HealthCheck.ps1, or specific script paths located in C:\Windows\System32\Tasks.

• Scenario: Legacy Application Maintenance and Reporting

  • Context: Internal business applications (such as custom ERP modules, HR portals, or legacy reporting dashboards) often run background C# services to generate daily reports or synchronize data. These internal tools may use the same underlying .NET frameworks and library GUIDs as external security assessment tools, triggering alerts during routine batch processing windows.