Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects adversary behavior where threat actors utilize C# Red/Black team tools that generate unique TypeLibGUID artifacts to establish persistence or execute reconnaissance within the environment. A SOC team should proactively hunt for these specific GUIDs in Azure Sentinel because their presence often signals early-stage tool deployment by attackers before they trigger more severe, high-level alerts.

YARA Rule

rule HKTL_NET_GUID_SneakyExec {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/HackingThings/SneakyExec"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "612590aa-af68-41e6-8ce2-e831f7fe4ccc" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypeLibGUID”, along with suggested filters or exclusions:

Scenario: Microsoft Office Background Services
- Context: In an enterprise environment, background processes like Microsoft.Office.Excel.Application or WinWord.exe frequently load COM type libraries (e.g., TypeLibGUID: 00020813-0000-0000-C000-000000000046) during scheduled macro execution, document rendering, or add-in initialization. These legitimate C#/.NET components often mimic the signature of red-team tools that rely on COM automation.
- Suggested Filter: Exclude processes where ImageName matches known Office executables (EXCEL.EXE, WINWORD.EXE, POWERPNT.EXE) AND the ParentProcessName is a scheduled task runner (e.g., TASKENG.EXE or SCHEDULER.SYS).
Scenario: Enterprise Endpoint Management Agents
- Context: Tools like Microsoft Intune, System Center Configuration Manager (SCCM), or Jamf Pro agents utilize C# to interact with the OS registry and file system. During policy updates or software deployment, these agents instantiate specific TypeLibGUIDs associated with .NET assemblies to manage inventory or execute scripts, triggering the rule as if a red-team reconnaissance tool were active.
- Suggested Filter: Create an exclusion for ImageName paths containing known vendor directories (e.g., \Program Files\Microsoft Intune\, \Program Files (x86)\Microsoft Configuration Manager\) and restrict the alert to only trigger if the CommandLine contains arguments not typical of standard maintenance jobs (e.g., exclude lines starting with `/