Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that generate unique typelibguid artifacts to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel is critical because low-severity detections often mask sophisticated tool usage, allowing analysts to distinguish legitimate administrative activity from stealthy adversary operations before they escalate into higher-impact incidents.

YARA Rule

rule HKTL_NET_GUID_The_Collection {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Tlgyt/The-Collection"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "579159ff-3a3d-46a7-b069-91204feb21cd" ascii nocase wide
        $typelibguid1 = "5b7dd9be-c8c3-4c4f-a353-fefb89baa7b3" ascii nocase wide
        $typelibguid2 = "43edcb1f-3098-4a23-a7f2-895d927bc661" ascii nocase wide
        $typelibguid3 = "5f19919d-cd51-4e77-973f-875678360a6f" ascii nocase wide
        $typelibguid4 = "17fbc926-e17e-4034-ba1b-fb2eb57f5dd3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• https://github.com/Tlgyt/The-Collection
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, tailored for an enterprise environment:

• Scenario: Automated Patch Deployment via SCCM/MECM

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) frequently utilizes C# assemblies with specific typelibguid signatures when executing software updates or inventory scans. These actions often mimic the behavior of Red Team reconnaissance tools scanning system libraries.
  • Suggested Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe and the file path contains \Microsoft\CCM\. Additionally, filter for known SCCM assembly hashes if available in the log stream.

• Scenario: Endpoint Protection Real-Time Scanning

  • Context: Enterprise EDR agents (such as CrowdStrike Falcon or Microsoft Defender) run scheduled real-time scans that load C# components to analyze file metadata and registry keys. The loading of these internal scanning modules triggers the typelibguid detection, often indistinguishable from a Black Team tool performing a similar sweep.
  • Suggested Filter/Exclusion: Create an exclusion for process names matching known EDR agents (e.g., CsFalconService.exe, MsMpEng.exe) and their child processes. Specifically, exclude events where the ImageName matches the organization’s standard endpoint protection executable list.

• Scenario: Office 365 Click-to-Run Updates

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) regularly updates installation packages and validates license keys using C# libraries with unique typelibguid entries. This background maintenance activity occurs during business hours and can be flagged as a suspicious tool execution.
  • Suggested Filter/Exclusion: Exclude events