Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies adversary activity by detecting C# Red and Black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. A proactive search is essential to distinguish legitimate security tooling from potential malicious C# processes that may mimic these known identifiers to evade standard detection mechanisms.

YARA Rule

rule HKTL_NET_GUID_scout {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jaredhaight/scout"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "d9c76e82-b848-47d4-8f22-99bf22a8ee11" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/jaredhaight/scout
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” along with suggested filters or exclusions:

• Scenario: Automated Backup and Recovery Jobs

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault utilize C# libraries to manage agent communication. These services often instantiate COM objects (via typelibguid) during scheduled nightly backups or incremental scans, mimicking the behavior of red-team reconnaissance tools.
  • Filter/Exclusion: Exclude processes running under specific service accounts (e.g., VeeamBackupService, CommServe) and restrict detection to non-standard user contexts. Add a filter for known Veeam/Commvault typelibguid hashes in the allowlist.

• Scenario: Endpoint Protection Scanning

  • Context: Next-generation antivirus platforms such as CrowdStrike Falcon or Microsoft Defender for Endpoint use C# components to perform real-time file system monitoring and policy updates. These tools frequently load specific type libraries during signature updates or on-access scanning, triggering the rule’s detection logic.
  • Filter/Exclusion: Create an exclusion based on the parent process name (e.g., Cns.exe, MsMpEng.exe) and the specific typelibguid associated with the EDR vendor’s internal C# modules.

• Scenario: Office 365 ProPlus Updates and Macro Execution

  • Context: In environments with heavy Microsoft 365 usage, the Office Click-to-Run service or background macro engines in Excel/Word often load C# interop assemblies to handle document rendering, add-in management, or scheduled update checks. These activities generate typelibguid events that resemble security tool initialization.
  • Filter/Exclusion: Exclude processes with