Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt identifies potential adversary activity by detecting the execution of known C# red and black team tools through their unique TypelibGUID signatures within Azure Sentinel. Proactively hunting for these indicators is essential to distinguish legitimate security operations from malicious tool usage that may mimic standard administrative behavior, thereby reducing false positives and uncovering stealthy reconnaissance or post-compromise activities.

YARA Rule

rule HKTL_NET_GUID_Stealer {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/malwares/Stealer"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "8fcd4931-91a2-4e18-849b-70de34ab75df" ascii nocase wide
        $typelibguid1 = "e48811ca-8af8-4e73-85dd-2045b9cca73a" ascii nocase wide
        $typelibguid2 = "d3d8a1cc-e123-4905-b3de-374749122fcf" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://github.com/malwares/Stealer
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID,” along with suggested filters or exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Jenkins, Azure DevOps) running automated unit tests using frameworks like NUnit, xUnit, or MSTest. These tools often load C# test assemblies that register specific TypeLibGUIDs during the build process.
  • Filter/Exclusion: Exclude processes originating from known CI/CD service accounts (e.g., NT SERVICE\jenkins-agent or SYSTEM) running on dedicated build servers, specifically filtering for command lines containing keywords like /test, dotnet test, or specific pipeline IDs.

• Scenario: Enterprise Endpoint Management & Patching

  • Context: Scheduled tasks executed by Microsoft SCCM (Configuration Manager) or Intune agents performing software inventory scans or deployment of .NET-based applications. These tools frequently instantiate C# components with unique TypeLibGUIDs to verify installation states.
  • Filter/Exclusion: Create an exclusion for the ccmexec.exe and Microsoft.IntuneManagementAgent.exe processes, specifically when they are running under the context of scheduled tasks named “Software Inventory” or “App Deployment.”

• Scenario: Internal DevOps Tooling & Monitoring

  • Context: Custom internal observability agents (e.g., a proprietary C# wrapper for Prometheus exporters or New Relic APM) running on application servers to collect telemetry. These tools often register COM interfaces with specific TypeLibGUIDs that overlap with Red Team tool signatures.
  • Filter/Exclusion: Whitelist the prometheus_exporter.exe and newrelic-agent.exe processes, ensuring