Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that expose unique typelibguid identifiers to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because they often indicate early-stage tool deployment that may evade standard signature-based detections, allowing analysts to validate legitimate operations before potential malicious activity escalates.

YARA Rule

rule HKTL_NET_GUID_RAT_TelegramSpyBot {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/SebastianEPH/RAT.TelegramSpyBot"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "8653fa88-9655-440e-b534-26c3c760a0d3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/SebastianEPH/RAT.TelegramSpyBot
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Scheduled Backup Verification via Veeam Agent

  • Context: The enterprise uses Veeam Agent for Windows, which includes a C# component (Veeam.Backup.Agent.Service) that registers specific TypeLib GUIDs during its nightly scheduled backup verification job. This activity mimics the behavior of Red Team reconnaissance tools scanning system libraries.
  • Filter/Exclusion: Create an exclusion rule to whitelist the process VeeamAgent.exe (or the specific service name) when it originates from the known backup server subnet, or specifically exclude the TypeLib GUIDs associated with the Veeam COM interface registry keys.

• Scenario: Office 365 ProPlus Automated Updates

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) frequently updates shared C# libraries and registers new TypeLib GUIDs during its weekly update cycle. This registration process can trigger the detection logic as it resembles a Red Team tool injecting code or modifying the registry to establish persistence.
  • Filter/Exclusion: Exclude events where the Image Path contains \Microsoft Office\ClickToRun\OfficeC2RClient.exe and the TypeLib GUID matches known Microsoft Office COM library signatures (e.g., those starting with {000...} ranges specific to MS Office).

• Scenario: SCCM/MECM Software Deployment Tasks

  • Context: During enterprise-wide software deployments, the System Center Configuration Manager (SCCM) client (ccmexec.exe) utilizes C# scripts to configure applications. These scripts often instantiate COM objects with unique TypeLib GUIDs that are indistinguishable from Blue Team monitoring agents or Red Team simulation tools without