Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting the presence of known C# Red and Black team security tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these indicators is essential to distinguish legitimate security operations from malicious tool usage that may mimic trusted software, thereby reducing false positives and uncovering stealthy reconnaissance or post-compromise activities.

YARA Rule

rule HKTL_NET_GUID_UnmanagedPowerShell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/leechristensen/UnmanagedPowerShell"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "dfc4eebb-7384-4db5-9bad-257203029bd9" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/leechristensen/UnmanagedPowerShell
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize C# agents that load specific COM libraries during scheduled nightly jobs. These agents may instantiate a typelibguid associated with the rule’s detection logic while processing file metadata or managing service states.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name (Veeam.Backup.Service.exe, commvault.cmd) and restrict the alert to run only outside of standard business hours (e.g., 02:00–06:00) or exclude specific service accounts used for backups.

• Scenario: Microsoft Office Deployment & Licensing Checks

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) and licensing validation tools frequently load C# components to manage feature updates, license verification, and activation. These processes often generate typelibguid events that mimic the signature of security testing tools.
  • Suggested Filter/Exclusion: Exclude process paths containing \Microsoft Office\ or specific known GUIDs associated with the Office Click-to-Run service (e.g., {9149340A-55EF-48B6-B7E1-2C5F...}). Additionally, filter out events where the parent process is msiexec.exe.

• Scenario: Endpoint Protection Agent Health Checks

  • Context: Modern EDR/XDR agents (such as CrowdStrike Falcon or Microsoft Defender for Endpoint) perform periodic health checks using internal C# modules. These modules interact with system COM interfaces to verify sensor status, which can trigger