Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis posits that adversaries are utilizing C#-based red and black team tools identified by unique TypeLib GUIDs to establish persistence or conduct reconnaissance within the environment. Proactive hunting in Azure Sentinel is essential because these specific tool signatures often indicate early-stage adversary activity that may be missed by standard alerting due to their low severity classification, requiring manual correlation with user behavior for accurate threat validation.

YARA Rule

rule HKTL_NET_GUID_Telegra_Csharp_C2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/sf197/Telegra_Csharp_C2"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "1d79fabc-2ba2-4604-a4b6-045027340c85" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/sf197/Telegra_Csharp_C2
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, along with suggested filters or exclusions:

• Scenario: Automated Software Deployment via Microsoft Endpoint Configuration Manager (MECM/SCCM)

  • Context: The SCCM client service (ccmexec.exe) frequently invokes C# deployment agents that load specific TypeLib GUIDs to install updates, patch management tools, or inventory scanners. These legitimate administrative operations often mimic the behavior of red-team reconnaissance tools.
  • Suggested Filter: Exclude events where ProcessName is ccmexec.exe and CommandLine contains keywords like “SoftwareUpdates”, “Inventory”, or “Deployment”. Additionally, whitelist the specific TypeLib GUIDs known to be part of the SCCM client package (e.g., {00000000-0000-0000-C000-000000000046}).

• Scenario: Scheduled Antivirus Real-Time Scanning and Definition Updates

  • Context: Enterprise Endpoint Detection and Response (EDR) or Antivirus solutions (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) utilize C# components to manage definition updates. These background jobs often register COM interfaces with specific TypeLib GUIDs that overlap with the detection logic for security tools.
  • Suggested Filter: Create an exclusion based on ParentProcessName being a known AV service (e.g., MsMpEng.exe, FalconSensorService.exe) and restrict the alert to non-business hours if the activity is strictly scheduled maintenance, or whitelist the specific GUIDs associated with the vendor’s update engine.

• Scenario: Microsoft Office 365 Click-to-Run Installation and Maintenance

  • Context: The `