Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects the execution of known C# Red and Black team security tools by identifying their unique TypeLibGUID signatures within process events. A SOC team should proactively hunt for these indicators in Azure Sentinel to distinguish legitimate security operations from potential adversary tooling that mimics standard administrative activities, thereby reducing false positives during incident response.

YARA Rule

rule HKTL_NET_GUID_Xploit {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/shargon/Xploit"
        author = "Arnim Rupp"
        date = "2020-12-21"
    strings:
        $typelibguid0 = "4545cfde-9ee5-4f1b-b966-d128af0b9a6e" ascii nocase wide
        $typelibguid1 = "33849d2b-3be8-41e8-a1e2-614c94c4533c" ascii nocase wide
        $typelibguid2 = "c2dc73cc-a959-4965-8499-a9e1720e594b" ascii nocase wide
        $typelibguid3 = "77059fa1-4b7d-4406-bc1a-cb261086f915" ascii nocase wide
        $typelibguid4 = "a4a04c4d-5490-4309-9c90-351e5e5fd6d1" ascii nocase wide
        $typelibguid5 = "ca64f918-3296-4b7d-9ce6-b98389896765" ascii nocase wide
        $typelibguid6 = "10fe32a0-d791-47b2-8530-0b19d91434f7" ascii nocase wide
        $typelibguid7 = "679bba57-3063-4f17-b491-4f0a730d6b02" ascii nocase wide
        $typelibguid8 = "0981e164-5930-4ba0-983c-1cf679e5033f" ascii nocase wide
        $typelibguid9 = "2a844ca2-5d6c-45b5-963b-7dca1140e16f" ascii nocase wide
        $typelibguid10 = "7d75ca11-8745-4382-b3eb-c41416dbc48c" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

References

• https://github.com/shargon/Xploit
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID,” along with suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM

  • Context: System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager frequently utilizes C#-based agents to deploy patches. These agents often load specific .NET assemblies containing unique TypelibGUIDs that match the signatures of red-team tools like Cobalt Strike Beacon or Sysmon Event Collector.
  • Filter/Exclusion: Exclude processes running under the service account NT SERVICE\CCMService where the parent process is ccmexec.exe. Additionally, filter out events where the command line contains keywords related to “SoftwareUpdates” or “PatchDeployment”.

• Scenario: Office 365 ProPlus Background Updates

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) performs background updates and feature installations using C# components. These components often instantiate COM objects with TypelibGUIDs that overlap with black-team forensic tools such as Kape Files (WinPE) or Velociraptor.
  • Filter/Exclusion: Create an exclusion for the process name OfficeClickToRun.exe and its child processes. Alternatively, filter events where the file path resides within C:\Program Files\Microsoft Office Root\Office16\.

• Scenario: Scheduled Antivirus Heuristic Scans

  • Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) run scheduled heuristic scans that utilize C# extensions to analyze memory and registry. These extensions often generate TypelibGUIDs similar to those used by red-team tools like BloodHound Ingestion or SharpUp.