Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based Red and Black team tools that register unique TypeLibGUIDs to establish persistence or conduct reconnaissance within the environment. Proactively hunting for these specific GUID signatures in Azure Sentinel allows the SOC team to distinguish legitimate security tooling from malicious implants, ensuring early visibility into potential lateral movement or command-and-control activities before they escalate.

YARA Rule

rule HKTL_NET_GUID_RunAsUser {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/atthacks/RunAsUser"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "9dff282c-93b9-4063-bf8a-b6798371d35a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/atthacks/RunAsUser
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule Detects C# Red/Black-Team Tools via TypelibGUID, along with suggested filters or exclusions:

• Automated Software Deployment via SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) frequently loads C# assemblies containing specific TypelibGUIDs during scheduled software updates, application deployments, or inventory scans. These legitimate background tasks often mimic the behavior of red-team reconnaissance tools.
  • Filter/Exclusion: Exclude processes with the image path matching C:\Windows\CCM\* and restrict alerts to non-business hours (e.g., 02:00–06:00) if deployments are scheduled for that window, or whitelist the specific TypelibGUIDs associated with Microsoft deployment agents.

• Enterprise Antivirus Real-Time Scanning

  • Scenario: Endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint utilize C# components to perform real-time file scanning and heuristic analysis. When these engines scan large directories or specific file types (like .dll or .exe), they instantiate libraries that match the rule’s TypelibGUID signatures, triggering alerts on standard security operations.
  • Filter/Exclusion: Add an exclusion for parent processes known to be security agents (e.g., C:\Program Files\CrowdStrike\*, C:\Windows\System32\MsMpEng.exe) and whitelist the specific TypelibGUID values documented in the vendor’s installation manifest.

• Scheduled PowerShell Administrative Tasks

  • Scenario: IT administrators often run scheduled PowerShell jobs (powershell.exe) to manage Active Directory users, patch compliance checks, or log rotation. These scripts frequently invoke C# classes (via Add-Type