Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for specific TypeLibGUID signatures associated with common C# red and blue team reconnaissance or post-exploitation tools within the Azure Sentinel environment. Proactively hunting for these indicators allows the SOC to distinguish between legitimate security operations and malicious tool usage, enabling early identification of attackers leveraging standard .NET frameworks to establish persistence or gather intelligence.

YARA Rule

rule HKTL_NET_GUID_TikiTorch {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/TikiTorch"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "806c6c72-4adc-43d9-b028-6872fa48d334" ascii nocase wide
        $typelibguid1 = "2ef9d8f7-6b77-4b75-822b-6a53a922c30f" ascii nocase wide
        $typelibguid2 = "8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6" ascii nocase wide
        $typelibguid3 = "1f707405-9708-4a34-a809-2c62b84d4f0a" ascii nocase wide
        $typelibguid4 = "97421325-b6d8-49e5-adf0-e2126abc17ee" ascii nocase wide
        $typelibguid5 = "06c247da-e2e1-47f3-bc3c-da0838a6df1f" ascii nocase wide
        $typelibguid6 = "fc700ac6-5182-421f-8853-0ad18cdbeb39" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• https://github.com/rasta-mouse/TikiTorch
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Microsoft Teams/Office Add-in Deployment

  • Context: During off-hours, the IT team deploys new Office add-ins or updates to Microsoft Teams using PowerShell scripts that invoke .NET assemblies. These tools often register specific Type Library GUIDs (e.g., 00020813-0000-0000-C000-000000000046 for Office) which mimic the signature of Red Team reconnaissance tools like SharpHound or Bloodhound.
  • Filter/Exclusion: Create an exclusion based on the ProcessName being msiexec.exe, powershell.exe, or winword.exe when the command line contains keywords like “deployment,” “update,” or “add-in.” Additionally, exclude traffic originating from known deployment servers (e.g., SCCM management points).

• Scenario: Scheduled Antivirus Engine Updates

  • Context: Enterprise EDR solutions (such as CrowdStrike Falcon, Carbon Black, or Symantec) utilize C# components for their update engines and policy synchronization. These services frequently load Type Libraries to communicate with the OS kernel, generating GUIDs that overlap with Black Team tools like SharpUp or PowerSploit.
  • Filter/Exclusion: Exclude processes belonging to known EDR vendors (e.g., C:\Program Files\CrowdStrike\csagent.exe, C:\Program Files\Carbon Black\cbengine.exe). Filter by time-of-day if updates are strictly scheduled between 02:00 and 04:00 UTC.

• Scenario: Internal Reporting Dashboard Refresh *