Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects the execution of known C# red and black team tools by identifying their unique TypeLib GUID signatures within Azure Sentinel logs. Proactively hunting for these artifacts is essential to distinguish legitimate security testing activities from potential adversary use of similar tooling that could mask malicious operations or indicate a sophisticated threat actor’s presence.

YARA Rule

rule HKTL_NET_GUID_USBTrojan {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/mashed-potatoes/USBTrojan"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "4eee900e-adc5-46a7-8d7d-873fd6aea83e" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/mashed-potatoes/USBTrojan
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects c# red/blue-team tools via typelibguid rule, including suggested filters and exclusions:

• Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Scenario: The SCCM client service (ccmexec.exe) frequently invokes C#-based PowerShell modules or custom scripts during scheduled hardware inventory cycles. These processes often load specific .NET assemblies containing typelibguid values that match known blue-team tool signatures, even though they are part of standard patch management rather than security operations.
  • Suggested Filter: Exclude process paths matching C:\Windows\CCM\* or specifically filter the parent process name to ccmexec.exe. Additionally, exclude events where the command line contains arguments related to “HardwareInventory” or “SoftwareUpdate”.

• Automated Office 365 ProPlus Deployment via Intune

  • Scenario: During scheduled maintenance windows, the Microsoft Endpoint Manager (Intune) agent executes C# deployment scripts to update Office applications. These scripts utilize typelibguid identifiers associated with common red-team reconnaissance tools (like those used for file enumeration or registry analysis), triggering alerts on standard user workstations during normal business hours.
  • Suggested Filter: Create an exclusion based on the process path containing \Microsoft Intune Management Extension\* or filter by the specific typelibguid values known to be unique to the Office deployment package (e.g., excluding GUIDs starting with 91480567-...).

• Enterprise Backup Solutions (Veeam/Commvault) Agent Scans

  • Scenario: Enterprise backup agents running as scheduled tasks often perform pre-backup validation using C# components to check file integrity and system state. These validation routines load libraries with typelibguid entries that overlap significantly