Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries are executing C#-based offensive or defensive utilities within the environment, identifiable by unique TypeLibGUID artifacts often associated with Red and Blue team tooling. Proactive hunting for these signatures in Azure Sentinel is essential to distinguish legitimate security operations from potential adversary reconnaissance or lateral movement activities that mimic standard administrative tools.

YARA Rule

rule HKTL_NET_GUID_CSharpSetThreadContext {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/djhohnstein/CSharpSetThreadContext"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "a1e28c8c-b3bd-44de-85b9-8aa7c18a714d" ascii nocase wide
        $typelibguid1 = "87c5970e-0c77-4182-afe2-3fe96f785ebb" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/djhohnstein/CSharpSetThreadContext
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated Compliance Scanning with Microsoft System Center Configuration Manager (SCCM)

  • Context: SCCM agents frequently execute C#-based inventory collection tasks that load specific TypeLib GUIDs associated with .NET Framework diagnostics. These scans run on a strict schedule across the entire endpoint fleet, generating high-volume alerts during business hours.
  • Filter/Exclusion: Create an exclusion for the process path C:\Windows\CCM\CcmExec.exe or specifically filter out TypeLib GUIDs known to be associated with SCCM inventory agents (e.g., GUID: 00000000-0000-0000-C000-000000000046) when the parent process is running under the SYSTEM or Network Service account.

• Scenario: Scheduled .NET Framework Health Checks via PowerShell

  • Context: Enterprise administrators often deploy scheduled tasks (Task Scheduler) that run custom PowerShell scripts to verify .NET runtime integrity. These scripts invoke C# assemblies which instantiate TypeLib GUIDs identical to those used by red-team reconnaissance tools, triggering alerts during the nightly maintenance window (e.g., 02:00–04:00).
  • Filter/Exclusion: Exclude events where the parent process is powershell.exe or pwsh.exe and the command line arguments contain keywords like -Command, -File, or specific internal script paths (e.g., C:\Scripts\HealthChecks\). Additionally, filter by time-of-day to ignore alerts occurring outside of standard business hours if the tooling is known to be maintenance-only.

• **Scenario: