Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLib GUIDs to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel is critical because it enables the SOC to distinguish legitimate administrative activity from stealthy tool deployment, even when initial alert severity remains low.

YARA Rule

rule HKTL_NET_GUID_physmem2profit {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/FSecureLABS/physmem2profit"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "814708c9-2320-42d2-a45f-31e42da06a94" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/FSecureLABS/physmem2profit
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule Detects c# red/blue-team tools via typelibguid, tailored for a legitimate enterprise environment:

• Microsoft Endpoint Configuration Manager (MECM/SCCM) Client Updates

  • Scenario: The SCCM client service (ccmexec.exe) frequently loads .NET assemblies to manage software updates and compliance checks. During these routine operations, the agent may instantiate specific COM objects or load libraries that share typelibguid signatures with common Red Team tools (e.g., mimicking SharpUp or PowerShell automation frameworks) as part of its inventory scanning process.
  • Filter/Exclusion: Create an exclusion for the parent process path C:\Program Files\Microsoft Configuration Manager\Client\ccmexec.exe and restrict the alert to only trigger if the specific typelibguid is not associated with known Microsoft-signed assemblies (e.g., check file signature publisher against “Microsoft Corporation”).

• Scheduled Antivirus Real-Time Scanning Tasks

  • Scenario: Enterprise Endpoint Detection and Response (EDR) or Antivirus solutions (such as CrowdStrike, SentinelOne, or Symantec) often utilize C# components for heuristic analysis. When a scheduled scan runs during business hours, the scanner may load internal .NET libraries that generate typelibguid events identical to those of Red Team reconnaissance tools like BloodHound collectors or SharpUp.
  • Filter/Exclusion: Exclude processes originating from known security vendor paths (e.g., C:\Program Files\CrowdStrike\, C:\Program Files\SentinelOne\) and filter by the specific scheduled task name (e.g., “Antivirus Real-Time Scan” or “Daily Compliance Check”) to suppress alerts during defined maintenance windows.

• IT Helpdesk Remote Management Sessions

  • **Scenario