Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt identifies the execution of C#-based red and black team tools by monitoring for specific TypeLibGUID artifacts often generated during reconnaissance or post-exploitation activities. Proactively hunting for these indicators in Azure Sentinel is critical to distinguish legitimate security engineering operations from potential adversary tooling that mimics standard administrative behavior, thereby reducing false negatives in low-severity alerts.

YARA Rule

rule HKTL_NET_GUID_bantam {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/gellin/bantam"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "14c79bda-2ce6-424d-bd49-4f8d68630b7b" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/gellin/bantam
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule Detects c# red/blue-team tools via typelibguid, along with suggested filters or exclusions:

• Automated Patch Deployment via SCCM/MECM

  • Scenario: System Center Configuration Manager (SCCM) agents utilize C#-based PowerShell modules to inventory software and deploy patches. These operations often instantiate Microsoft.Update or custom COM objects that generate specific typelibguid entries identical to those used by security assessment tools. This is most common during scheduled maintenance windows on domain-joined workstations.
  • Filter/Exclusion: Exclude events where the parent process name matches ccmexec.exe (SCCM Agent) or TaskSchedulerService, and restrict the scope to specific OU paths containing “PatchManagement” or “Maintenance”.

• Enterprise Antivirus Real-Time Scanning

  • Scenario: Major EDR solutions like CrowdStrike, SentinelOne, or Symantec Endpoint Protection utilize C# components for their real-time scanning engines. When these agents scan large file repositories (e.g., SQL databases or virtual machine images), they load type libraries that trigger the rule’s logic, mimicking the behavior of a red-team reconnaissance tool.
  • Filter/Exclusion: Create an exclusion for processes with known antivirus signatures (e.g., csagent.exe, s1service.exe, rtvscan.exe) and filter out events originating from the “System” account or specific service accounts dedicated to security operations.

• Scheduled Backup and Archiving Jobs

  • Scenario: Enterprise backup solutions such as Veeam Backup & Replication or Commvault often run C#-based agents that interact with file systems using COM interfaces. During nightly backup windows, these agents instantiate type libraries for data compression and encryption, generating typelibguid events that look like active threat hunting