Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C# tools commonly used in both offensive and defensive operations through their unique TypeLibGUID signatures within Azure Sentinel. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate security tooling and suspicious red-team simulations or malicious reconnaissance, ensuring early visibility into specialized threat actor behaviors that may otherwise blend with routine system noise.

YARA Rule

rule HKTL_NET_GUID_Quasar {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/quasar/Quasar"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "cfda6d2e-8ab3-4349-b89a-33e1f0dab32b" ascii nocase wide
        $typelibguid1 = "c7c363ba-e5b6-4e18-9224-39bc8da73172" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/quasar/Quasar
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: CI/CD agents (e.g., Azure DevOps or GitHub Actions runners) frequently execute C# build tasks that instantiate .NET assemblies containing specific typelibguid values associated with Red Team simulation frameworks. These legitimate builds often mimic the footprint of active security tools.
  • Filter/Exclusion: Create an exclusion rule for processes running under the service account of the CI/CD agent (e.g., AzureDevOpsAgentService) or restrict detection to exclude executable paths located within the build server’s installation directory (e.g., C:\Program Files\Microsoft\VisualStudio\*).

• Scenario: Scheduled Backup and Inventory Scans

  • Context: Enterprise backup solutions (such as Veeam or Commvault) utilize C# components to inventory application registries. During scheduled nightly jobs, these tools query the Windows Registry for Type Library GUIDs to map dependencies, triggering alerts that resemble Red Team reconnaissance activities.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts from backup service accounts (e.g., VeeamBackupService) during their defined maintenance windows (e.g., 02:00 – 04:00 local time) or exclude specific process names like vss.exe and commvaultcmd.exe.

• Scenario: Endpoint Management Agent Updates

  • Context: Unified Endpoint Management tools (like Microsoft Intune, SCCM, or CrowdStrike Falcon) perform routine health checks and configuration updates. These agents often load C# modules that register new Type Library GUIDs to verify compliance policies, which can be misidentified as the deployment of a new Black Team tool