Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies the execution of known C# red and black team engagement tools by analyzing unique TypeLibGUID artifacts within Azure Sentinel logs. Proactively hunting for these specific tool signatures is essential to distinguish authorized security testing activities from potential adversary use of similar custom frameworks that may evade standard signature-based defenses.

YARA Rule

rule HKTL_NET_GUID_TheHackToolBoxTeek {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/teeknofil/TheHackToolBoxTeek"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "2aa8c254-b3b3-469c-b0c9-dcbe1dd101c0" ascii nocase wide
        $typelibguid1 = "afeff505-14c1-4ecf-b714-abac4fbd48e7" ascii nocase wide
        $typelibguid2 = "4cf42167-a5cf-4b2d-85b4-8e764c08d6b3" ascii nocase wide
        $typelibguid3 = "118a90b7-598a-4cfc-859e-8013c8b9339c" ascii nocase wide
        $typelibguid4 = "3075dd9a-4283-4d38-a25e-9f9845e5adcb" ascii nocase wide
        $typelibguid5 = "295655e8-2348-4700-9ebc-aa57df54887e" ascii nocase wide
        $typelibguid6 = "74efe601-9a93-46c3-932e-b80ab6570e42" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• https://github.com/teeknofil/TheHackToolBoxTeek
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-team tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated Security Scanning with Microsoft Defender for Endpoint

  • Context: The enterprise utilizes Microsoft Defender for Endpoint (or similar EDR) which runs scheduled background scans using a C#-based engine. These tools often load specific Type Libraries to interact with the OS, generating typelibguid events that mimic Red/Black team reconnaissance tools.
  • Suggested Filter: Create an exclusion based on the Parent Process Name (MsMpEng.exe or SenseClientService.exe) combined with a whitelist of known benign typelibguid values associated with Microsoft security components.

• Scenario: Office 365 ProPlus Click-to-Run Updates

  • Context: During scheduled maintenance windows, the Office Click-to-Run service (OfficeC2RClient.exe) performs background updates and configuration checks. This C# application frequently instantiates Type Libraries to verify registry keys and COM objects, triggering alerts that resemble active threat hunting tools.
  • Suggested Filter: Exclude events where the Process Command Line contains arguments related to Update or Configuration, specifically filtering for the process path C:\Program Files\Microsoft Office\root\Office16\.

• Scenario: Internal Patch Management Deployment (e.g., SCCM/MECM)

  • Context: System Center Configuration Manager (SCCM) agents execute deployment tasks using C# wrappers to install software patches. These agents load Type Libraries to manage application manifests and verify installation status, which the detection logic may misinterpret as a Red Team tool deployment.
  • Suggested Filter: Implement an exclusion based on the User Account running the process (e.g., `NT AUTHORITY