Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies the execution of specialized C# Red and Black team security tools by analyzing unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC to distinguish between legitimate security operations and potential adversary activity that mimics standard tooling behavior, ensuring early visibility into reconnaissance or post-exploitation phases.

YARA Rule

rule HKTL_NET_GUID_StandIn {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/FuzzySecurity/StandIn"
        author = "Arnim Rupp"
        date = "2020-12-21"
    strings:
        $typelibguid0 = "01c142ba-7af1-48d6-b185-81147a2f7db7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/FuzzySecurity/StandIn
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated Deployment of Microsoft Visual Studio Extensions

  • Context: During nightly CI/CD pipelines, the build server (e.g., Azure DevOps or Jenkins) installs or updates C# extensions within Visual Studio. These installations often register new COM type libraries that match the GUIDs associated with Red/Black team reconnaissance tools.
  • Suggested Filter: Exclude processes running under the VSTT (Visual Studio Team Services) service account or filter by process path containing \Program Files\Microsoft Visual Studio\.

• Scenario: Scheduled Execution of Microsoft Endpoint Configuration Manager (SCCM)

  • Context: The SCCM client agent runs scheduled maintenance tasks to update software inventories and deploy C#-based management agents. These background services frequently instantiate type libraries that trigger the detection logic due to overlapping GUIDs used by enterprise management suites.
  • Suggested Filter: Create an exclusion for process names ccmexec.exe or WUAHandler.exe when executed from the \Windows\CCM\ directory, specifically during the defined maintenance window (e.g., 02:00 – 04:00).

• Scenario: Development Environment Build Artifacts on Engineering Workstations

  • Context: Software engineers compile C# projects locally using MSBuild or .NET SDKs. The compilation process generates temporary type libraries that mimic the signature of Red/Black team tools, particularly when developers are testing security scanning plugins within their IDEs.
  • Suggested Filter: Exclude alerts originating from host groups tagged as “Engineering” or “Dev-Box,” and filter out processes with command lines containing msbuild.exe or dotnet.exe.