Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversary use of common C# red and black team tools by identifying specific NET_GUID type library artifacts that often indicate reconnaissance or post-exploitation activities. Proactively hunting for these signatures in Azure Sentinel is critical because low-severity detections may be overlooked, allowing attackers to establish a foothold using legitimate-looking tooling before escalating their operations.

YARA Rule

rule HKTL_NET_GUID_wsManager {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/guillaC/wsManager"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "9480809e-5472-44f3-b076-dcdf7379e766" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/guillaC/wsManager
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the HKTL_NET_GUID_wsManager detection rule, tailored for an enterprise environment:

• Enterprise Software Deployment via SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) or a dedicated deployment agent executes a C#-based installer to update internal management agents. These installers often load the wsManager library to register new Windows services, triggering the rule due to the presence of the specific NET_GUID.
  • Suggested Filter: Exclude processes where the parent process is ccmexec.exe or WuaAgentHost.exe, and the file path contains \Microsoft SCCM\ or \Windows\CCM\.

• Scheduled .NET Framework Health Checks

  • Scenario: A nightly scheduled task runs a custom C# diagnostic script (e.g., DotNetHealthCheck.exe) to verify the integrity of the .NET runtime on domain-joined workstations. This tool utilizes the wsManager type library to query registry keys and service states, generating the exact GUID signature detected by the YARA rule.
  • Suggested Filter: Create an exclusion for processes launched by Task Scheduler (svchost.exe -k netsvcs) with a command line argument containing /scheduled or running during off-hours (e.g., 02:00–05:00 local time) on the specific executable hash known to be the health check tool.

• Internal IT Helpdesk Remote Management Suite

  • Scenario: The organization uses a proprietary C# remote management suite (e.g., “IT-Connect Agent”) that runs continuously in the background. When an administrator initiates a “Black Team” simulation or a routine inventory scan, the agent loads the wsManager component to enumerate