Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypelibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate security testing operations and malicious tool deployment that may mimic known benign frameworks, thereby reducing false positives while uncovering stealthy reconnaissance efforts.

YARA Rule

rule HKTL_NET_GUID_AntiDebug {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/malcomvetter/AntiDebug"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "997265c1-1342-4d44-aded-67964a32f859" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/malcomvetter/AntiDebug
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: The System Center Configuration Manager (SCCM) or Microsoft Intune client (ccmexec.exe or Microsoft.IntuneManagementAgent) frequently invokes C#-based deployment engines that load specific TypeLib GUIDs to manage application installations and updates. These operations often trigger the rule when scanning for .NET assemblies during package distribution.
  • Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe or Microsoft.IntuneManagementAgent.exe, specifically filtering out events occurring within the standard maintenance window (e.g., 08:00–18:00 on weekdays).

• Scenario: Microsoft Defender for Endpoint (MDE) Scanning

  • Context: The Microsoft Defender Antivirus service (MsMpEng.exe) utilizes C# components to perform real-time scanning and heuristic analysis. When MDE scans a directory containing .NET applications, it may instantiate TypeLib GUIDs associated with its internal management tools, mimicking the behavior of Red/Black team reconnaissance tools.
  • Filter/Exclusion: Create an exclusion rule for any process where ImageName equals MsMpEng.exe and the CommandLine contains parameters related to “RealTime” or “OnAccess” scanning.

• Scenario: Scheduled PowerShell Automation Jobs

  • Context: Enterprise IT operations often rely on scheduled tasks (Task Scheduler) running complex PowerShell scripts (powershell.exe) that load C# libraries for reporting, backup verification, or compliance checks. These scripts frequently instantiate TypeLib GUIDs to interact with the Windows Management Instrumentation (WMI) or Office COM objects.