Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that register unique TypeLibGUIDs to establish a persistent foothold or conduct reconnaissance within the environment. The SOC team should proactively hunt for these specific GUID signatures in Azure Sentinel to identify early-stage tool deployment that may otherwise be missed by standard signature-based detections, enabling faster response to potential lateral movement or command-and-control activities.

YARA Rule

rule HKTL_NET_GUID_PowerOPS {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/fdiskyou/PowerOPS"
        author = "Arnim Rupp"
        date = "2020-12-21"
    strings:
        $typelibguid0 = "2a3c5921-7442-42c3-8cb9-24f21d0b2414" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/fdiskyou/PowerOPS
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID,” along with suggested filters or exclusions:

• Scenario: Automated CI/CD Build Agents

  • Context: Enterprise build servers (e.g., Jenkins, Azure DevOps, GitHub Actions) frequently execute C# compilation tasks using msbuild.exe or dotnet.exe. These processes often load standard .NET runtime assemblies that contain the same TypelibGUID signatures associated with Red/Black team tools.
  • Filter/Exclusion: Exclude process paths matching known build agent binaries (e.g., C:\Program Files\Jenkins\jenkins-agent\msbuild.exe, D:\AzureDevOps\_tasks\dotnet.exe) or filter by the parent process name being a specific service account (e.g., NT SERVICE\BuildAgent).

• Scenario: Microsoft Office Add-in Initialization

  • Context: When users launch Microsoft Office applications (Word, Excel) with installed C#-based add-ins (such as SharePoint integration tools or custom reporting plugins), the host process (WINWORD.EXE, EXCEL.EXE) registers COM interfaces that share the target TypelibGUID. This is a common administrative baseline activity.
  • Filter/Exclusion: Create an exclusion for processes where the parent image name contains “Office” (e.g., WINWORD.EXE, OUTLOOK.EXE) and the command line arguments do not contain specific tool identifiers like RedTeam or BlackTeam.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Many enterprise endpoint protection suites utilize C# components for their update engines. When a scheduled job runs to fetch definitions, the updater service may instantiate a .NET assembly with the matching GUID, mimicking the signature of security assessment tools