Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C# Red/Black team tools that register unique TypeLib GUIDs in the Windows Registry to establish persistence or execute custom scripts. Proactively hunting for these specific artifacts in Azure Sentinel is critical because their presence often indicates advanced reconnaissance or post-exploitation activities that may evade standard signature-based detections due to their low severity classification.

YARA Rule

rule HKTL_NET_GUID_WindowsPlague {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/RITRedteam/WindowsPlague"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "cdf8b024-70c9-413a-ade3-846a43845e99" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/RITRedteam/WindowsPlague
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects c# red/black-team tools via typelibguid rule (HKTL_NET_GUID_W), tailored for an enterprise environment:

• Microsoft Office Click-to-Run Updates

  • Scenario: The OfficeClickToRun.exe process frequently registers new COM type libraries during scheduled background updates or user logins. These operations generate C# assemblies with unique TypeLib GUIDs that mimic the structure of Red/Blue team reconnaissance tools, particularly when updating Excel or Outlook add-ins.
  • Filter/Exclusion: Exclude processes where ImageName equals OfficeClickToRun.exe AND ParentImageName is Microsoft Office Click-to-Run Service, specifically targeting GUIDs starting with the Microsoft Office root namespace (e.g., {000...}).

• Enterprise Antivirus Real-Time Scanning

  • Scenario: Next-gen endpoint protection suites (such as CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection) utilize C# components for their real-time scanning engines. When these agents scan large directories or perform heuristic analysis, they load internal .NET libraries that register TypeLib GUIDs identical to those used by security automation frameworks.
  • Filter/Exclusion: Create a whitelist rule excluding ImageName patterns matching known EDR executables (e.g., falcon.sys, SentinelOne.exe, Symantec Antivirus) and filter out events where the UserAccount is the local system account (NT AUTHORITY\SYSTEM).

• SQL Server Reporting Services (SSRS) Execution

  • Scenario: In environments running on-premise or hybrid SQL Server instances, the ReportServer.exe service executes complex C# reports and data processing tasks. These jobs often instantiate temporary .NET assemblies with TypeLib GUIDs that trigger the rule during peak