Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies the execution of known C# red and black team security tools by monitoring for specific TypeLibGUID artifacts within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC to distinguish between authorized testing activities and potential adversary reconnaissance that mimics legitimate tooling behavior.

YARA Rule

rule HKTL_NET_GUID_ToxicEye {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/LimerBoy/ToxicEye"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "1bcfe538-14f4-4beb-9a3f-3f9472794902" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-team tools via TypelibGUID rule, including suggested filters and exclusions:

Scenario: Automated CI/CD Pipeline Build Agents
- Context: Enterprise build servers (e.g., Jenkins, Azure DevOps, or GitHub Actions runners) frequently compile .NET applications. During the compilation phase, these agents invoke csc.exe (C# Compiler) and related MSBuild tools which instantiate specific C# assemblies containing unique TypelibGUIDs often flagged as “Red Team” reconnaissance tools.
- Suggested Filter: Exclude processes running under service accounts associated with build infrastructure (e.g., svc-build-agent, jenkins-service) or restrict the rule to only trigger on workstations and not on servers designated in the Build-Infrastructure OU.
Scenario: Scheduled Endpoint Protection Updates
- Context: Enterprise EDR agents (such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black) perform scheduled scans and signature updates using C# components to interface with the OS registry and file system. These background jobs often load libraries with GUIDs that overlap with known red-team tooling signatures used for lateral movement simulation.
- Suggested Filter: Create an exclusion based on the parent process name (e.g., falcon.sys, MsMpEng.exe) or exclude specific TypelibGUID values known to belong to the organization’s primary EDR vendor by cross-referencing with the asset inventory database.
Scenario: Microsoft Office 365 ProPlus Background Tasks
- Context: In environments where users have heavy Office usage, background processes like OfficeClickToRun.exe or Groove.exe (SharePoint Workspace) utilize C# libraries for add-in management and cloud synchronization. These tools often register Type Libraries