Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate security testing operations and malicious reconnaissance or tool deployment that mimics standard administrative behavior.

YARA Rule

rule HKTL_NET_GUID_RexCrypter {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/syrex1013/RexCrypter"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "10cd7c1c-e56d-4b1b-80dc-e4c496c5fec5" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/syrex1013/RexCrypter
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including targeted filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: Continuous Integration/Continuous Deployment (CI/CD) servers (e.g., Jenkins, Azure DevOps) frequently compile C# applications using msbuild.exe or dotnet.exe. These processes often load standard .NET Framework assemblies that contain the specific typelibguid signatures associated with security tools, triggering alerts during routine build jobs.
  • Filter/Exclusion: Exclude process paths containing known CI/CD service accounts (e.g., Jenkins Service, BuildAgent) and restrict the rule to exclude processes running under the System or specific NetworkService accounts on designated build server hostnames.

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Updates

  • Context: During scheduled maintenance windows, SCCM clients execute deployment tasks that install or update C#-based management agents and reporting tools. These background services often instantiate COM objects with typelibguid identifiers that overlap with the Red/Black team tool signatures, causing high-volume alerts during patch cycles.
  • Filter/Exclusion: Create an exclusion for processes spawned by ccmsetup.exe, wuauserv.exe, or TpmService running on the domain controller or management point servers. Additionally, filter out events occurring within a 2-hour window of known maintenance schedules (e.g., Sundays 02:00–04:00).

• Scenario: Enterprise Antivirus Heuristic Scanning

  • Context: Modern EDR/Anti-malware solutions (such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec) utilize C# modules to perform real-time file system monitoring