Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing C#-based red and black team tools within the Azure environment, identifiable by unique TypeLibGUID signatures often associated with legitimate security utilities but frequently repurposed for malicious activities. Proactively hunting for these specific GUIDs in Azure Sentinel is critical to distinguish between authorized tool usage and potential lateral movement or reconnaissance efforts that may otherwise blend into normal background noise due to their low severity classification.

YARA Rule

rule HKTL_NET_GUID_EvilWMIProvider {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/sunnyc7/EvilWMIProvider"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "a4020626-f1ec-4012-8b17-a2c8a0204a4b" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/sunnyc7/EvilWMIProvider
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, tailored for an enterprise environment:

• Scheduled Microsoft Endpoint Configuration Manager (SCCM) Updates

  • Scenario: The SCCM client service (ccmexec.exe) or the Software Center application executes a scheduled inventory scan or software deployment task. These processes often instantiate C# assemblies that register specific TypeLib GUIDs associated with the Microsoft Deployment Toolkit, which may overlap with known Red Team tool signatures (e.g., tools mimicking System.Management).
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe or SoftwareCenter.exe and the user account is a service account (e.g., NT AUTHORITY\SYSTEM or DOMAIN\SCCM_Service_Acct) during standard business hours maintenance windows.

• Automated PowerShell Script Execution via Task Scheduler

  • Scenario: A routine administrative PowerShell script (.ps1) runs via the Windows Task Scheduler to perform user provisioning or log rotation. If the script loads a custom C# DLL for reporting or data processing, it may generate a typelibguid that matches the detection logic’s signature for Red Team reconnaissance tools like BloodHound collectors or SharpUp.
  • Filter/Exclusion: Create an exclusion rule for processes launched by TaskScheduler.exe where the command line contains specific known script paths (e.g., \Scripts\HR_Provisioning.ps1) and the executing user is a domain admin service account.

• Microsoft 365 Copilot or Teams Background Processes

  • Scenario: The Microsoft Teams desktop application or the Office Click-to-Run Service (OfficeClickToRun.exe) performs background updates or initializes the new “Copilot” sidecar feature. These modern C#