Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of C# Red/Black team tools identified by unique typelibguid values, which often indicate reconnaissance or post-exploitation activities within an Azure environment. Proactively hunting for these specific tool signatures in Azure Sentinel is critical to distinguish legitimate security operations from malicious actors leveraging similar frameworks to establish persistence or evade standard detection rules.

YARA Rule

rule HKTL_NET_GUID_ReverseShell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/chango77747/ReverseShell"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "980109e4-c988-47f9-b2b3-88d63fababdc" ascii nocase wide
        $typelibguid1 = "8abe8da1-457e-4933-a40d-0958c8925985" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid” in an enterprise environment, along with suggested filters:

Scenario: Automated Office Add-in Deployment
- Context: Enterprise IT administrators frequently deploy Microsoft Office add-ins (e.g., custom Outlook plugins or Excel macros) using C# applications. These installations often register specific TypeLib GUIDs to enable COM interop between the add-in and the host application during scheduled maintenance windows.
- Suggested Filter: Exclude alerts where the parent process is msiexec.exe or setup.exe running under a known service account (e.g., DOMAIN\svc_deploy) and the TypeLib GUID matches the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths.
Scenario: Endpoint Detection and Response (EDR) Self-Updates
- Context: Major EDR solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint utilize C# components to manage their own updates and agent health checks. These internal processes often instantiate COM objects with TypeLib GUIDs that mimic the signatures of Red/Blue team tools, particularly when scanning or updating the sensor itself on domain-joined workstations.
- Suggested Filter: Create an exclusion for known EDR executable paths (e.g., C:\Program Files\CrowdStrike\csagent.exe or C:\Windows\System32\MsMpEng.exe) and whitelist their associated TypeLib GUIDs which are static across the fleet.
Scenario: Scheduled PowerShell Script Execution
- Context: IT Operations teams run scheduled PowerShell scripts (Task Scheduler) to perform routine health checks, log rotation, or configuration backups. These scripts often invoke C# assemblies via System.Reflection to interact with local system components, generating TypeLib GUID events that resemble active threat