Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries are executing C#-based red or black team tools within the environment, identifiable by unique TypeLibGUID artifacts often missed by standard signature-based detection. Proactively hunting for these specific GUIDs in Azure Sentinel is critical to distinguish legitimate security tooling from malicious activity masquerading as benign automation, thereby reducing false negatives in low-severity alerts.

YARA Rule

rule HKTL_NET_GUID_TruffleSnout {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/dsnezhkov/TruffleSnout"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "33842d77-bce3-4ee8-9ee2-9769898bb429" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/dsnezhkov/TruffleSnout
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects c# red/blue-team tools via typelibguid rule, tailored for an enterprise environment:

• Scheduled Patch Management Deployments

  • Scenario: Enterprise patching solutions like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti utilize C#-based agents to scan and deploy updates. During nightly maintenance windows, these agents load specific TypeLib GUIDs associated with their internal inventory engines, mimicking the signature of Red Team reconnaissance tools.
  • Filter/Exclusion: Create an exclusion rule for processes running under the SYSTEM or dedicated service accounts (e.g., NT SERVICE\CCMExec) originating from known patch management binary paths (e.g., C:\Program Files\Microsoft Configuration Manager\).

• Automated Software Asset Inventory Scans

  • Scenario: Tools such as SolarWinds Service Desk, Lansweeper, or Snipe-IT agents perform periodic hardware and software discovery. These C# applications enumerate installed .NET assemblies and registry keys, generating the same typelibguid events that the rule flags as potential Blue Team enumeration or Red Team footprinting.
  • Filter/Exclusion: Exclude events where the parent process is a known inventory agent (e.g., LansweeperAgent.exe, SolarWinds.Agent.Service) and the execution time falls within defined business hours or scheduled maintenance windows (e.g., 02:00–04:00 UTC).

• Identity Management & Group Policy Updates

  • Scenario: During large-scale Group Policy Object (GPO) refreshes or identity synchronization tasks using Microsoft Identity Manager (MIM) or Azure AD Connect, C# components interact with the Local Security Authority. These interactions often trigger TypeLib GUID registrations related