Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing custom C# tools with unique TypeLibGuid identifiers to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because they often represent known red and black team artifacts that may be overlooked by standard signature-based alerts, allowing analysts to distinguish between authorized testing activities and potential malicious tool deployment.

YARA Rule

rule HKTL_NET_GUID_DInvoke_PoC {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/dtrizna/DInvoke_PoC"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "5a869ab2-291a-49e6-a1b7-0d0f051bef0e" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/dtrizna/DInvoke_PoC
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Microsoft Office Add-in Deployment

  • Scenario: The installation or background update of Microsoft Office (Outlook, Excel) triggers the creation of specific Type Library GUIDs associated with VSTO (Visual Studio Tools for Office) add-ins. These tools often run as C# processes (excel.exe, outlook.exe) and register COM libraries that mimic the signature of red-team reconnaissance tools.
  • Filter/Exclusion: Exclude events where the process image path contains \Microsoft Office\ or \Office16\ AND the parent process is setup.exe or msiexec.exe.

• Scheduled .NET Framework Health Checks

  • Scenario: Enterprise-wide scheduled tasks (e.g., running every morning at 02:00) utilize custom C# scripts to validate .NET framework integrity on endpoints. These scripts often instantiate standard Type Libraries for diagnostic purposes, generating the specific GUIDs monitored by this rule during routine maintenance windows.
  • Filter/Exclusion: Create a time-based exclusion for events occurring between 01:30 and 04:30 local time where the process name matches known internal monitoring tools (e.g., DotNetHealthCheck.exe) or is launched by TaskScheduler (svchost.exe -k netsvcs).

• Citrix Virtual Apps & Desktops Agent Activity

  • Scenario: In virtualized environments, the Citrix Workspace App or VDA (Virtual Delivery Agent) frequently registers C# components to manage session policies and user profiles. The background service CtxSM.exe often loads Type Libraries that share GUID patterns with security assessment tools, causing alerts during user logon sessions.