Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that expose unique TypeLibGUID artifacts to establish persistent command-and-control or reconnaissance capabilities within the environment. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because they often represent low-noise, legitimate-looking executables that can bypass standard signature-based defenses while executing advanced threat simulation activities.

YARA Rule

rule HKTL_NET_GUID_GRAT2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/r3nhat/GRAT2"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "5e7fce78-1977-444f-a18e-987d708a2cff" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/r3nhat/GRAT2
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/blue-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/MECM

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) or the Software Update Agent frequently loads C# assemblies containing specific typelibguid values during scheduled patch installation windows. This often occurs on thousands of endpoints simultaneously, mimicking the behavior of a red team scanning tool.
  • Suggested Filter: Exclude events where the parent process is ccmexec.exe or WUAUWorker10.exe and the execution path contains \Microsoft\CCM\.

• Scenario: Endpoint Protection Health Checks (CrowdStrike/SentinelOne)

  • Context: Modern EDR agents like CrowdStrike Falcon Sensor (csfalcon.exe) or SentinelOne (SentinelAgent.exe) perform routine integrity scans and behavioral monitoring using internal C# components. These agents often register COM libraries with GUIDs that overlap with known red team tool signatures (e.g., tools used for memory analysis).
  • Suggested Filter: Create an exclusion based on the ImageName matching known EDR binaries (csfalcon.exe, SentinelAgent.exe, CarbonBlack-64.exe) and restrict the rule to trigger only if the process is running outside of standard service accounts (e.g., filter out NT SERVICE\CrowdStrike Falcon Service).

• Scenario: Microsoft Office 365 ProPlus Updates

  • Context: The Office Click-to-Run service (OfficeClickToRun.exe) or the Office Background Task Handler (OfficeBackgroundTaskHandlerRegistration.exe) frequently instantiates C# libraries to manage feature updates and license validation. These operations generate `typelibguid