Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that expose unique typelibguid artifacts to establish a foothold or conduct reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel allows the SOC team to distinguish legitimate administrative activities from stealthy tool deployment, ensuring early visibility into potential lateral movement or post-exploitation phases even when initial alert severity is low.

YARA Rule

rule HKTL_NET_GUID_HTTPSBeaconShell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "aca853dc-9e74-4175-8170-e85372d5f2a9" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/limbenjamin/HTTPSBeaconShell
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters and exclusions:

• Scenario: Automated Patch Management Deployment

  • Context: Enterprise patch management tools (e.g., Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti) frequently utilize C# components to inventory software and deploy updates. These agents often instantiate specific COM libraries with known TypelibGUIDs during their scheduled daily maintenance windows, mimicking the behavior of red team reconnaissance tools.
  • Suggested Filter: Exclude processes running under the context of the patch management service account (e.g., NT SERVICE\SCCMService) and restrict alerts to non-business hours if the tool is known to run only overnight. Alternatively, whitelist the specific TypelibGUID associated with the vendor’s standard agent DLLs.

• Scenario: Internal IT Service Desk Ticketing Automation

  • Context: Custom C# scripts or plugins integrated into ticketing systems (e.g., ServiceNow, Jira Service Management, or internal SharePoint workflows) often execute background jobs to sync user data, generate reports, or trigger automated remediation. These legitimate administrative tasks invoke the same underlying .NET Framework libraries that red team tools use for system enumeration.
  • Suggested Filter: Create an exclusion based on the parent process name (e.g., w3wp.exe, jira-service.exe) and the specific user account running the job (e.g., DOMAIN\IT-Automation-Svc). Ensure the filter targets only known internal IP ranges where these service accounts operate.

• Scenario: Endpoint Security Agent Health Checks

  • Context: Modern EDR/XDR solutions (such as CrowdStrike Falcon, SentinelOne, or **Microsoft Defender for