Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting the presence of known Red and Black team C# tools through their unique TypeLib GUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC to distinguish between authorized security operations and malicious tool deployment, ensuring that legitimate testing activities are not mistaken for threats while maintaining visibility into unauthorized tool usage.

YARA Rule

rule HKTL_NET_GUID_Pen_Test_Tools {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/awillard1/Pen-Test-Tools"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "922e7fdc-33bf-48de-bc26-a81f85462115" ascii nocase wide
        $typelibguid1 = "ad5205dd-174d-4332-96d9-98b076d6fd82" ascii nocase wide
        $typelibguid2 = "b67e7550-f00e-48b3-ab9b-4332b1254a86" ascii nocase wide
        $typelibguid3 = "5e95120e-b002-4495-90a1-cd3aab2a24dd" ascii nocase wide
        $typelibguid4 = "295017f2-dc31-4a87-863d-0b9956c2b55a" ascii nocase wide
        $typelibguid5 = "abbaa2f7-1452-43a6-b98e-10b2c8c2ba46" ascii nocase wide
        $typelibguid6 = "a4043d4c-167b-4326-8be4-018089650382" ascii nocase wide
        $typelibguid7 = "51abfd75-b179-496e-86db-62ee2a8de90d" ascii nocase wide
        $typelibguid8 = "a06da7f8-f87e-4065-81d8-abc33cb547f8" ascii nocase wide
        $typelibguid9 = "ee510712-0413-49a1-b08b-1f0b0b33d6ef" ascii nocase wide
        $typelibguid10 = "9780da65-7e25-412e-9aa1-f77d828819d6" ascii nocase wide
        $typelibguid11 = "7913fe95-3ad5-41f5-bf7f-e28f080724fe" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 12 string patterns in its detection logic.

References

• https://github.com/awillard1/Pen-Test-Tools
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Automated Compliance Scanning by Microsoft Defender for Endpoint

  • Context: The endpoint protection agent (running as a scheduled task) utilizes C# libraries to scan file integrity and registry configurations. This process frequently instantiates COM objects with specific typelibguid values associated with the .NET framework used by the security suite, mimicking red-team reconnaissance tools.
  • Suggested Filter: Exclude processes where the parent image path contains \Microsoft Defender Antimalware\ or \Windows Defender\, and restrict the rule to only trigger if the typelibguid is not present in a known “trusted library” whitelist (e.g., Microsoft-signed GUIDs).

• Scenario: Enterprise Software Deployment via SCCM/MECM

  • Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) executes C#-based deployment scripts to install patches or update applications. These scripts often load specific Type Libraries for configuration management, generating events that match the signature of black-team automation tools used in penetration testing.
  • Suggested Filter: Create an exclusion based on the ProcessName being ccmexec.exe or WmiPrvSE.exe, and filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the user account is a dedicated service account like NT SERVICE\CCM.

• Scenario: Internal IT Helpdesk Ticketing Automation

  • Context: A custom internal C# application used by the IT helpdesk team runs background jobs to sync ticket data with Active Directory. This tool utilizes specific COM interfaces for user profile management, triggering the detection logic when it queries user attributes or