Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects the execution of C#-based red and black team tools by identifying unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these artifacts is essential to distinguish legitimate security testing activities from potential adversary reconnaissance or tool deployment that mimics standard development workflows.

YARA Rule

rule HKTL_NET_GUID_WheresMyImplant {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xbadjuju/WheresMyImplant"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "cca59e4e-ce4d-40fc-965f-34560330c7e6" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/0xbadjuju/WheresMyImplant
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated CI/CD Build Pipelines

  • Context: Enterprise build servers (e.g., Azure DevOps Agents or Jenkins) frequently execute C# compilation tasks using MSBuild or the .NET SDK. These processes often load specific COM components that register unique TypeLibGUIDs, mimicking the signature of Red/Black team tools like SharpShell or custom analysis agents.
  • Filter/Exclusion: Exclude processes running under the context of service accounts (e.g., NT SERVICE\TeamBuildAgent) and restrict detection to specific executable paths known for build operations, such as C:\Program Files\Microsoft Visual Studio\*\MSBuild\Bin\MSBuild.exe or dotnet.exe.

• Scenario: Microsoft Office Add-in Initialization

  • Context: When users launch Microsoft Office applications (Word, Excel) with enterprise-wide add-ins installed via Group Policy, the background C# logic of these add-ins registers TypeLibGUIDs. Tools like Power Automate Desktop or custom compliance checkers often trigger this rule during user login or application startup, appearing as security tool activity.
  • Filter/Exclusion: Create an exclusion for processes with parent images matching Office executables (WINWORD.EXE, EXCEL.EXE) and filter out TypeLibGUIDs belonging to known Microsoft Office add-in namespaces (e.g., GUIDs starting with 0002 or specific vendor prefixes).

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise EDR solutions (such as CrowdStrike Falcon, Carbon Black, or SentinelOne) often utilize C# based modules for behavioral analysis. During scheduled deep scans, these agents load internal