Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging C#-based red and black team tools identifiable by unique TypeLibGUID signatures to establish persistence or conduct reconnaissance within the environment. Proactive hunting for these specific GUIDs in Azure Sentinel is critical because low-severity detections often indicate early-stage tool deployment that could evolve into significant threats if not correlated with broader behavioral anomalies.

YARA Rule

rule HKTL_NET_GUID_SyscallPOC {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/SolomonSklash/SyscallPOC"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "1e54637b-c887-42a9-af6a-b4bd4e28cda9" ascii nocase wide
        $typelibguid1 = "198d5599-d9fc-4a74-87f4-5077318232ad" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/SolomonSklash/SyscallPOC
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule in an enterprise environment:

• Automated Patch Management Deployments

  • Scenario: Enterprise patch management systems (e.g., Microsoft Endpoint Configuration Manager (MECM) or Ivanti) frequently deploy C#-based agents to scan and remediate endpoints. These tools often instantiate specific .NET assemblies containing unique TypelibGUIDs that overlap with known Red/Blue team reconnaissance libraries during routine inventory scans.
  • Suggested Filter: Exclude processes running under the context of the patch management service account (e.g., NT SERVICE\CCMExec) and restrict the rule to only trigger if the parent process is not a known deployment orchestrator like ccmexec.exe or ivanti_agent_service.exe.

• Scheduled Software Asset Inventory Jobs

  • Scenario: Internal IT asset management tools (such as Lansweeper, ManageEngine Endpoint Central, or custom PowerShell/C# scripts) run nightly scheduled tasks to enumerate installed software. These jobs utilize C# libraries with TypelibGUIDs identical to those used by security assessment frameworks, generating alerts during the standard maintenance window (e.g., 02:00–04:00 UTC).
  • Suggested Filter: Create a time-based exclusion for the specific hash of the inventory agent executable during business hours or apply a filter that suppresses alerts where the ParentProcessName matches known asset discovery tools (e.g., LansweeperAgent.exe, AssetDiscoveryService.exe).

• Enterprise Application Deployment & Configuration

  • Scenario: DevOps pipelines utilizing Azure DevOps Agents, Jenkins, or Octopus Deploy often execute C# build and release tasks on enterprise servers. During the installation