Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis posits that adversaries are executing C#-based red or black team tools within the environment, identifiable by unique TypeLibGUID signatures often associated with known security utilities. Proactively hunting for these artifacts in Azure Sentinel is critical to distinguish legitimate security operations from potential adversary use of similar tooling, ensuring no malicious activity is overlooked despite the rule’s low severity classification.

YARA Rule

rule HKTL_NET_GUID_ShellGen {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jasondrawdy/ShellGen"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "c6894882-d29d-4ae1-aeb7-7d0a9b915013" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule in an enterprise environment, along with suggested filters or exclusions:

Scenario: Microsoft Office Click-to-Run Updates and Background Services
- Context: The OfficeClickToRun.exe process frequently loads various C# assemblies (such as System.Management.Automation.dll or internal telemetry libraries) that share common TypeLibGUIDs with known red-team tools like Cobalt Strike’s Beacon or Empire. This often occurs during scheduled maintenance windows when Office updates are applied automatically across the fleet.
- Suggested Filter: Exclude processes where the parent process is OfficeClickToRun.exe and the file path matches the standard Microsoft installation directory (e.g., C:\Program Files\Microsoft Office\root\). Additionally, filter out events occurring during known maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Enterprise Endpoint Detection and Response (EDR) Self-Scanning
- Context: Major EDR solutions (such as CrowdStrike Falcon Sensor, Microsoft Defender for Endpoint, or SentinelOne) utilize C# components to perform real-time scanning and behavioral analysis. These agents often inject DLLs into target processes that generate TypeLibGUID signatures identical to those used by black-team tools like Mimikatz or SharpUp during their own internal health checks and signature updates.
- Suggested Filter: Create an exclusion for the specific EDR sensor process names (e.g., CsAgent.exe, MsMpEng.exe, SentinelOneService.exe) acting as the parent process. If the rule triggers on a child process spawned by these agents, suppress the alert if the loaded assembly path resides within the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\).