Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLibGUIDs to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific GUID signatures in Azure Sentinel is critical because they often represent known security tooling that may be misused by attackers to blend into legitimate administrative activity, thereby evading standard anomaly detection.

YARA Rule

rule HKTL_NET_GUID_Anti_Analysis {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/Anti-Analysis"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "3092c8df-e9e4-4b75-b78e-f81a0058a635" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/NYAN-x-CAT/Anti-Analysis
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Scenario: The SCCM client service (ccmexec.exe) frequently loads various C# assemblies during policy refresh cycles or software deployment tasks. These operations often instantiate standard .NET libraries that share the same TypelibGUID signatures as common red-team tools (e.g., Mimikatz or SharpUp) used for credential dumping and process enumeration.
  • Suggested Filter: Exclude processes where the parent process is ccmexec.exe AND the file path contains \Microsoft Configuration Manager\. Additionally, filter out events occurring during standard maintenance windows defined in your IT calendar.

• Automated Backup Solutions (e.g., Veeam or Commvault)

  • Scenario: Enterprise backup agents utilize C# components to perform real-time file indexing and pre-backup validation scans. These background jobs often invoke COM objects with GUIDs identical to those used by black-team tools for memory analysis, triggering alerts during nightly backup windows even though no security investigation is taking place.
  • Suggested Exclusion: Create a whitelist rule excluding specific executable hashes or file paths associated with known backup agents (e.g., Veeam.Backup.Agent.exe, CommServe.exe). Ensure the exclusion applies specifically to the TypelibGUID values commonly used by these vendors’ .NET frameworks.

• Scheduled PowerShell Health Checks via C# Wrappers

  • Scenario: IT Operations teams often deploy scheduled tasks that run custom C# scripts or wrappers (compiled as .exe) to monitor system health, disk usage, and service status. These tools may load the same TypeLib GUIDs used by red-team reconnaissance tools like SharpHound