Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt identifies adversary activity by correlating specific typelibguid values associated with known C# Red and Black team tools to distinguish legitimate security operations from potential malicious reconnaissance or lateral movement. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to validate tool usage patterns, reduce false positives from authorized activities, and rapidly detect unauthorized deployment of similar C# utilities by attackers.

YARA Rule

rule HKTL_NET_GUID_XORedReflectiveDLL {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/r3nhat/XORedReflectiveDLL"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "c0e49392-04e3-4abb-b931-5202e0eb4c73" ascii nocase wide
        $typelibguid1 = "30eef7d6-cee8-490b-829f-082041bc3141" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/r3nhat/XORedReflectiveDLL
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-team tools via TypelibGUID rule, tailored for an enterprise environment:

• Scheduled .NET Framework Health Checks by System Center Operations Manager (SCOM)

  • Scenario: The SCOM agent on Windows Server workstations periodically executes a native PowerShell or C# script to query the local .NET runtime version and registry health. This process invokes clr.dll or specific monitoring assemblies that register unique TypelibGUIDs, mimicking the signature of Red Team reconnaissance tools scanning for .NET vulnerabilities.
  • Filter/Exclusion: Create an exclusion based on the parent process name (HealthService.exe or OpManagerAgent.exe) and restrict the alert to the specific TypelibGUID range observed during the initial baseline scan of SCOM agents.

• Microsoft Defender for Endpoint (MDE) Real-Time Protection Scans

  • Scenario: During off-hours, MDE performs deep behavioral scans using its C#-based engine components to analyze memory structures and loaded assemblies. These internal scanning modules generate distinct TypelibGUIDs that overlap with known Black Team tool signatures (such as those used for memory dumping or process injection analysis).
  • Filter/Exclusion: Exclude events where the initiating process is MsMpEng.exe or SenseClientService.exe, and filter by the specific hash of the executable generating the TypelibGUID to distinguish it from external red team binaries.

• Automated Office 365 ProPlus Update Deployment via SCCM

  • Scenario: The System Center Configuration Manager (SCCM) client service triggers a scheduled job to deploy or verify Microsoft Office updates. This involves loading C# interop assemblies (e.g., Microsoft.Office.Interop.Excel.dll) which register specific TypelibGUIDs often associated with document analysis and automation tools used by security teams