Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLib GUIDs to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific artifacts in Azure Sentinel is critical because their presence often indicates advanced tooling usage that may bypass standard signature-based detections, allowing analysts to validate authorized activities against potential stealthy intrusions.

YARA Rule

rule HKTL_NET_GUID_ShellcodeLoader {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Hzllaga/ShellcodeLoader"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "a48fe0e1-30de-46a6-985a-3f2de3c8ac96" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/Hzllaga/ShellcodeLoader
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters and exclusions:

• Scheduled Antivirus Definition Updates

  • Scenario: Enterprise endpoint protection suites (e.g., Microsoft Defender, CrowdStrike, or Symantec) often utilize C# components to manage definition updates. When the scheduled update job runs, it may instantiate a temporary C# process that registers or queries specific Type Library GUIDs associated with the vendor’s management console, mimicking the behavior of Red/Blue team reconnaissance tools.
  • Filter/Exclusion: Exclude processes originating from known antivirus installation paths (e.g., C:\Program Files\Microsoft Defender\) and specifically filter out the executable name MpCmdRun.exe or MsMpEng.exe when they interact with Type Library GUIDs belonging to the vendor’s official namespace.

• Automated Software Deployment via SCCM/Intune

  • Scenario: During routine patch management cycles, tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune agents execute C# deployment scripts (ccmexec.exe or DeviceCloudConnector.exe). These agents frequently load .NET assemblies that define Type Library GUIDs to verify software inventory or install updates, triggering the detection logic intended for security tooling.
  • Filter/Exclusion: Create an exclusion based on the parent process being a known deployment agent (e.g., ccmexec.exe, IntuneManagementExtender) and restrict alerts to only trigger if the specific Type Library GUID does not match the known inventory of internal deployment frameworks.

• IT Helpdesk Remote Support Sessions

  • Scenario: IT support staff frequently use remote desktop tools (e.g., TeamViewer, AnyDesk, or Microsoft Quick Assist) which rely heavily on C# libraries for screen capture and session