Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLib GUIDs to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific artifacts in Azure Sentinel is critical because their presence often indicates active threat emulation or advanced persistent threats utilizing custom tooling that may bypass standard signature-based detections.

YARA Rule

rule HKTL_NET_GUID_Privilege_Escalation {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Mrakovic-ORG/Privilege_Escalation"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "ed54b904-5645-4830-8e68-52fd9ecbb2eb" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the C# Red/Black-Team Tools via TypelibGUID detection rule, including suggested filters and exclusions:

Scenario: Automated Patch Management Deployment
- Context: Enterprise patch management solutions (e.g., Microsoft Endpoint Configuration Manager (MECM) or Ivanti) frequently utilize C# components to inventory software and deploy updates. These tools often instantiate COM objects with specific TypelibGUIDs that mimic the signatures of Red/Black team reconnaissance utilities during scheduled maintenance windows.
- Suggested Filter: Exclude processes originating from known patch management service accounts (e.g., NT SERVICE\MSCorSvc, System) running under the parent process path C:\Program Files\Microsoft Configuration Manager\ or C:\Program Files\Ivanti\. Additionally, filter for execution times strictly within defined maintenance windows (e.g., 02:00–04:00 local time).
Scenario: Office 365 ProPlus Background Updates
- Context: The Microsoft Office suite relies heavily on C# libraries and COM add-ins. When the Office Click-to-Run Service (OfficeC2RClient.exe) or Microsoft Update Health Tools perform background updates or license validation, they generate TypelibGUID events that can be indistinguishable from security tooling activity.
- Suggested Filter: Create an exclusion for the process name OfficeC2RClient.exe, WinWord.exe, and Outlook.exe when the parent process is Microsoft Office Click-to-Run Service. Specifically, whitelist the known TypelibGUIDs associated with standard Microsoft Office add-ins (e.g., those starting with {000...} or specific Office GUID ranges) to reduce noise from routine user workstations.
**Scenario: Internal