Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel. Proactively hunting for these specific tool identifiers allows the SOC team to distinguish between legitimate security testing operations and suspicious reconnaissance or lateral movement attempts that may otherwise be obscured in standard telemetry.

YARA Rule

rule HKTL_NET_GUID_Watson {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/Watson"
        author = "Arnim Rupp"
        date = "2020-12-21"
    strings:
        $typelibguid0 = "49ad5f38-9e37-4967-9e84-fe19c7434ed7" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/rasta-mouse/Watson
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: During nightly builds, the enterprise Jenkins or Azure DevOps agents utilize C#-based automation scripts (e.g., NuGet.exe or custom build runners) to restore dependencies and compile code. These tools often instantiate COM objects that generate specific TypeLibGUIDs associated with .NET frameworks, mimicking Red/Black team tool signatures.
  • Filter/Exclusion: Create a whitelist exclusion based on the Source Host (e.g., Jenkins-Builder-01, AzureDevOps-Agent-Pool) and the Process Name (msbuild.exe, dotnet.exe). Exclude events where the parent process is a known CI service account.

• Scenario: Scheduled Office 365/SharePoint Provisioning Tasks

  • Context: A scheduled PowerShell job runs every morning to provision new SharePoint sites or update Exchange mailboxes using C# libraries (e.g., Microsoft.SharePoint.Client or System.Management.Automation). These operations invoke COM interfaces that match the TypeLibGUIDs used by security analysis tools.
  • Filter/Exclusion: Implement a time-based filter for events occurring between 02:00 and 04:00 UTC originating from the Domain Controller or specific SharePoint Farm Servers. Additionally, exclude processes running under the SYSTEM or dedicated service accounts (e.g., svc-sharepoint-provisioning).

• Scenario: Endpoint Protection Policy Updates via C# Agents

  • Context: The organization uses a C#-based endpoint management agent (such as CrowdStrike Falcon or Carbon Black) that periodically queries system configuration. When the