Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that expose unique TypeLibGUID identifiers to establish persistence or conduct reconnaissance within the environment. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because they often indicate early-stage tool deployment or lateral movement activities that may not yet trigger standard high-severity alerts due to their low initial risk profile.

YARA Rule

rule HKTL_NET_GUID_logger {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/xxczaki/logger"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "9e92a883-3c8b-4572-a73e-bb3e61cfdc16" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/xxczaki/logger
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Detects C# Red/Black-team tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Scheduled Automated Patch Deployment (SCCM/Microsoft Endpoint Configuration Manager)

  • Context: The enterprise uses Microsoft SCCM to deploy .NET-based updates. During the scheduled maintenance window (e.g., 2:00 AM), the ccmexec.exe process or a specific deployment agent invokes C# assemblies containing known TypeLibGUIDs associated with security scanning tools to verify patch integrity before installation.
  • Filter/Exclusion: Create an exclusion rule for processes named ccmexec.exe, UpdateOrchestrator.exe, or WuaUerSvc.exe originating from the trusted path C:\Windows\CCM\*. Additionally, filter out events occurring during the defined maintenance window (02:00–04:00 UTC) on endpoints tagged as “Production Servers.”

• Scenario: Corporate Endpoint Protection Health Checks (CrowdStrike or SentinelOne)

  • Context: The organization’s EDR solution (e.g., CrowdStrike Falcon Sensor) runs a daily self-diagnostic routine. This internal health check utilizes C# libraries to validate the sensor’s communication with the cloud console, triggering the specific TypeLibGUIDs that the detection rule flags as “Red Team” reconnaissance tools.
  • Filter/Exclusion: Exclude events where the parent process is FalconSensorService.exe (CrowdStrike) or S1Service.exe (SentinelOne). Ensure the exclusion applies specifically to file paths located within C:\Program Files\CrowdStrike\* or C:\ProgramData\SentinelOne\*.

• Scenario: Internal Compliance Audit Script Execution

  • Context: The IT Security