Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies adversary activity by detecting the execution of known C# red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel. Proactive hunting for these specific indicators is essential to distinguish legitimate security testing from potential malicious reconnaissance or tool deployment that could be leveraged for lateral movement or data exfiltration.

YARA Rule

rule HKTL_NET_GUID_Absinthe {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/cameronhotchkies/Absinthe"
        author = "Arnim Rupp"
        date = "2020-12-21"
    strings:
        $typelibguid0 = "9936ae73-fb4e-4c5e-a5fb-f8aaeb3b9bd6" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/cameronhotchkies/Absinthe
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Deployment of .NET Applications via CI/CD Pipelines

  • Context: During build or release windows, internal CI/CD agents (e.g., Azure DevOps Agents, Jenkins) compile C# projects. The compilation process (csc.exe or msbuild) often instantiates specific COM typelib GUIDs associated with .NET runtime components that mimic the signatures of Red Team tools like BloodHound or SharpView.
  • Filter/Exclusion: Exclude processes where the parent is a known CI/CD service (e.g., VSTS.Agent.exe, Jenkins.exe) AND the executable path contains \Builds\ or \Artifacts\.

• Scenario: Scheduled Microsoft Endpoint Configuration Manager (SCCM) Inventory Tasks

  • Context: The SCCM client (ccmexec.exe) runs scheduled inventory jobs that scan installed software and registry keys. These tasks frequently load C# assemblies to query system state, triggering typelib GUIDs identical to those used by Black Team forensic tools like Sysmon or custom PowerShell wrappers.
  • Filter/Exclusion: Create an exclusion for the process name ccmexec.exe when the command line contains arguments related to “Inventory” or “Software Metering,” specifically excluding typelib GUIDs associated with standard Microsoft .NET Framework versions (e.g., {203C1A6E-7D5F-4B89-B8E3-...}).

• Scenario: Execution of Enterprise Backup Solutions (Veeam/Commvault)

  • Context: Modern backup agents utilize C# libraries for metadata processing and agent communication. When the Veeam Agent or