Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that leave distinct typelibguid artifacts within the Azure environment. Proactively hunting for these specific identifiers allows the SOC team to distinguish between legitimate security operations and potential adversary reconnaissance or lateral movement activities that might otherwise be obscured by low-severity noise.

YARA Rule

rule HKTL_NET_GUID_AzureCLI_Extractor {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0x09AL/AzureCLI-Extractor"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "a73cad74-f8d6-43e6-9a4c-b87832cdeace" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypeLibGuid rule, including suggested filters and exclusions:

Scenario: Scheduled Antivirus Definition Updates
- Context: Enterprise Endpoint Protection agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often use C# components to handle background definition updates. These processes invoke COM interfaces with specific TypeLibGuid values that overlap with known red-team tool signatures.
- Filter/Exclusion: Exclude the specific process image paths of the AV engine (e.g., C:\Program Files\Microsoft Defender\MsMpEng.exe) and filter out events where the parent process is TaskScheduler or a known service account (e.g., NT SERVICE\DefenderSvc).
Scenario: Microsoft Office Add-in Initialization
- Context: In environments with heavy document processing, legitimate C# add-ins for Microsoft Office (such as Adobe Acrobat PDFMaker, Kofax Power PDF, or custom HR document processors) load upon user login. These tools register COM type libraries that match the rule’s detection logic for red-team reconnaissance tools.
- Filter/Exclusion: Create an exclusion list based on the CommandLine argument containing specific publisher names (e.g., “Adobe Inc.”, “Kofax”) and restrict alerts to non-standard user accounts if the tool is expected only in shared service accounts.
Scenario: Automated Patch Management Deployment
- Context: Configuration management tools like SCCM (Microsoft Endpoint Configuration Manager) or Ansible Tower agents utilize C# scripts to deploy patches. During deployment, these agents instantiate temporary COM objects to verify system state, triggering the TypeLibGuid detection logic intended for black-team emulation tools.
- Filter/Exclusion: Exclude events occurring during defined maintenance windows (e.g