Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that generate unique TypeLibGUID artifacts to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel allows the SOC team to distinguish legitimate security tooling from potential adversary activity, ensuring early detection of custom or modified offensive frameworks before they escalate into high-severity incidents.

YARA Rule

rule HKTL_NET_GUID_rat_shell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/stphivos/rat-shell"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "7a15f8f6-6ce2-4ca4-919d-2056b70cc76a" ascii nocase wide
        $typelibguid1 = "1659d65d-93a8-4bae-97d5-66d738fc6f6c" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid,” including suggested filters and exclusions:

Scenario: Automated Build Pipeline Execution
- Context: Continuous Integration/Continuous Deployment (CI/CD) agents (e.g., Jenkins, Azure DevOps, or GitHub Actions runners) frequently execute C# compilation tasks. These agents often invoke msbuild.exe or dotnet.exe, which load standard .NET Framework type libraries to resolve dependencies and generate build artifacts.
- Suggested Filter: Exclude processes originating from known CI/CD service accounts (e.g., NT SERVICE\jenkins-agent) and restrict the detection scope to exclude specific parent process paths located in standard build directories (e.g., C:\Program Files\Microsoft Visual Studio, D:\BuildAgents).
Scenario: Windows Update Service Deployment
- Context: The Windows Update service (wuauserv) or the Microsoft Defender Antivirus engine often scans and installs updates for .NET Framework components. During this process, the system loads specific TypeLib GUIDs associated with the .NET runtime to verify component integrity before applying patches.
- Suggested Filter: Create an exclusion rule that ignores events where the ParentProcessName is TrustedInstaller.exe, wuauserv.dll, or MsMpEng.exe, specifically when the target TypeLib GUID matches known Microsoft-signed .NET runtime libraries (e.g., 0f31bfc7-a4f5-4e58-8729-26d9e7c5a000).
Scenario: Scheduled Office 365 ProPlus Maintenance
- Context: Enterprise endpoints running Microsoft Office 365 often execute scheduled maintenance tasks (via OfficeClickToRun.exe or