Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversary behavior where attackers utilize C# Red/Black team tools that generate unique typelibguid artifacts to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel is critical because low-severity alerts may be overlooked, allowing threat actors to maintain a stealthy foothold before escalating their activities.

YARA Rule

rule HKTL_NET_GUID_WhiteListEvasion {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/khr0x40sh/WhiteListEvasion"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "858386df-4656-4a1e-94b7-47f6aa555658" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters and exclusions:

Scenario: Automated Patch Deployment via SCCM/Microsoft Endpoint Configuration Manager
- Context: During scheduled maintenance windows, the ccmexec.exe or WUAHandler processes on endpoint machines utilize C# assemblies to query hardware inventory. These queries often instantiate specific TypeLib GUIDs associated with internal Red Team simulation tools (e.g., a custom asset discovery agent) that share library signatures with known offensive frameworks like Cobalt Strike or Empire.
- Suggested Filter/Exclusion: Create an exclusion for the process path C:\Windows\CCM\CcmExec.exe and C:\Program Files (x86)\Microsoft\Update Agent\WUAHandler.exe. Additionally, filter out events where the parent process is svchost.exe running under the “Network Service” account during defined maintenance hours (e.g., 02:00–04:00 UTC).
Scenario: Enterprise Antivirus Real-Time Scanning and Heuristic Analysis
- Context: Modern EDR agents (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) frequently load C# libraries to perform deep heuristic analysis of running processes. When scanning a legitimate administrative tool (like a PowerShell script runner), the AV engine may spawn a temporary worker process that registers a TypeLib GUID identical to those used by Black Team tools like “BloodHound” or “SharpUp”.
- Suggested Filter/Exclusion: Exclude events where the Image path contains known EDR vendor directories (e.g., \CrowdStrike\, \SentinelOne\, \Windows Defender\) and the process name matches standard sensor workers (e.g., csagent.exe,