Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that generate unique typelibguid artifacts to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel is critical because it enables the SOC team to distinguish between authorized security tooling and malicious activity masquerading as legitimate administrative processes, even when standard severity alerts are low.

YARA Rule

rule HKTL_NET_GUID_PowerShdll {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/p3nt4/PowerShdll"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "36ebf9aa-2f37-4f1d-a2f1-f2a45deeaf21" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/p3nt4/PowerShdll
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via Microsoft Endpoint Configuration Manager (MECM)

  • Context: During scheduled maintenance windows, the MECM client (ccmexec.exe) or the associated Microsoft.Update.Client service executes C#-based deployment agents to install security patches. These agents often instantiate COM objects with specific TypelibGUIDs that match known red-team tool signatures (e.g., mimicking PowerShell remoting or .NET framework diagnostics).
  • Suggested Filter/Exclusion: Create an exclusion for the parent process ccmexec.exe and Microsoft.Update.Client when running on endpoints within the IT-Infrastructure OU. Additionally, filter out events occurring during defined maintenance windows (e.g., Sundays 02:00–06:00 UTC).

• Scenario: Enterprise Antivirus Deep Scan with .NET Integration

  • Context: When a scheduled deep scan is triggered by an EDR solution like CrowdStrike or SentinelOne, the scanner’s C# module interacts with the Windows Registry and file system using COM interfaces. The specific TypelibGUIDs used for these internal scanning components often overlap with those of common red-team tools (such as SharpHound or custom .NET reconnaissance scripts).
  • Suggested Filter/Exclusion: Exclude events where the parent process name matches known EDR agents (CmService.exe, SentinelOne.exe) and the command line contains keywords like “DeepScan”, “OnDemand”, or “Scheduled”.

• Scenario: Internal CI/CD Pipeline Agent Execution

  • Context: Build servers (e.g., Azure Dev Agents or Jenkins nodes) frequently run C# build tasks, unit tests, and deployment