Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for specific TypeLibGUID signatures associated with known C# Red and Black team tools that may indicate reconnaissance or post-exploitation tooling. Proactively hunting for these indicators in Azure Sentinel is essential to distinguish legitimate security operations from malicious actors leveraging similar frameworks to establish persistence or evade standard signature-based defenses.

YARA Rule

rule HKTL_NET_GUID_PoC {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/thezdi/PoC"
        author = "Arnim Rupp"
        date = "2020-12-21"
    strings:
        $typelibguid0 = "89f9d411-e273-41bb-8711-209fd251ca88" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/thezdi/PoC
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Microsoft Visual Studio Build & Deployment

  • Context: During automated CI/CD pipelines or developer workstations, devenv.exe (Visual Studio) compiles C# projects. The build process often instantiates COM objects with specific TypeLibGUIDs that overlap with known Red Team tool signatures to load project metadata and manage NuGet packages.
  • Filter/Exclusion: Exclude processes where the parent executable is devenv.exe or msbuild.exe. Additionally, filter out events occurring within the standard build directory paths (e.g., C:\Builds\, D:\Artifacts\).

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Context: The SCCM client (ccmsetup.exe or ccmexec.exe) frequently runs scheduled maintenance tasks that utilize C# libraries to manage software inventory and compliance reporting. These background jobs often trigger the specific TypeLibGUIDs associated with Red Team reconnaissance tools during their discovery phase.
  • Filter/Exclusion: Create an exclusion for process names matching ccmsetup.exe, ccmexec.exe, or WuaHandler.exe when running under the system account (NT AUTHORITY\SYSTEM) on management servers and client endpoints.

• Scenario: Automated PowerShell Reporting Scripts

  • Context: Enterprise IT operations often rely on scheduled PowerShell scripts (e.g., Get-ADUser, Invoke-CimMethod) to generate compliance reports. These scripts invoke .NET assemblies that instantiate COM interfaces with TypeLibGUIDs identical to those used by Black Team monitoring agents like Sysmon or custom telemetry collectors.
  • Filter/Exclusion: