Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLib GUIDs to establish persistence or execute reconnaissance within the Azure environment. Proactively hunting for these specific identifiers allows the SOC team to distinguish legitimate administrative activities from stealthy tool usage, enabling early identification of potential lateral movement or post-exploitation phases before they escalate into high-severity incidents.

YARA Rule

rule HKTL_NET_GUID_Internal_Monologue {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/eladshamir/Internal-Monologue"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "0c0333db-8f00-4b68-b1db-18a9cacc1486" ascii nocase wide
        $typelibguid1 = "84701ace-c584-4886-a3cf-76c57f6e801a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/eladshamir/Internal-Monologue
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters or exclusions:

• Scenario: Automated Software Deployment via SCCM/MECM

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) frequently executes C#-based deployment agents to install updates or software packages. These agents often load specific TypeLib GUIDs associated with Microsoft management libraries during the installation phase, mimicking the signature of Red/Blue team reconnaissance tools.
  • Filter/Exclusion: Exclude processes where ParentImage is ccmexec.exe and the running user is a system account (e.g., NT AUTHORITY\SYSTEM). Additionally, filter out TypeLib GUIDs known to belong to Microsoft Configuration Manager SDK libraries.

• Scenario: Scheduled PowerShell Health Checks

  • Context: Enterprise administrators often schedule recurring PowerShell jobs (powershell.exe or pwsh.exe) to perform health checks on critical services (e.g., Exchange, SQL Server). These scripts frequently invoke C# assemblies for reporting and telemetry, generating TypeLib GUIDs that overlap with those used by security assessment tools like Nmap wrappers or custom vulnerability scanners.
  • Filter/Exclusion: Create an exclusion for powershell.exe processes launched by the Task Scheduler service (svchost.exe with TaskScheduler session) during defined business hours (e.g., 08:00–18:00). Whitelist specific TypeLib GUIDs identified in a baseline scan of these standard administrative scripts.

• Scenario: Endpoint Protection Real-Time Scanning

  • Context: Third-party Endpoint Detection and Response (EDR) solutions, such as CrowdStrike Falcon or SentinelOne, utilize C# components for their real-time scanning engines. When these agents