Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based Red and Black team tools that expose unique TypeLibGUID artifacts to establish persistence or conduct reconnaissance within the environment. Proactively hunting for these specific GUIDs in Azure Sentinel allows the SOC team to distinguish legitimate security operations from covert adversary tooling, ensuring early identification of potential lateral movement or data exfiltration activities before they escalate.

YARA Rule

rule HKTL_NET_GUID_Crypter_Runtime_AV_s_bypass {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/netreverse/Crypter-Runtime-AV-s-bypass"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "c25e39a9-8215-43aa-96a3-da0e9512ec18" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/netreverse/Crypter-Runtime-AV-s-bypass
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Patch Management Deployment (SCCM/Microsoft Endpoint Configuration Manager)

  • Context: During scheduled maintenance windows, the SCCM client (ccmexec.exe) or the associated deployment engine utilizes C# libraries to generate inventory reports or validate software installations. These legitimate operations often instantiate COM objects with GUIDs that overlap with those used by security assessment tools (e.g., Microsoft.VisualStudio.TestTools or specific System.Management.Automation modules).
  • Suggested Filter: Exclude process paths containing \Program Files\Microsoft Configuration Manager\Client\ccmexec.exe and parent processes named SMS_EXECUTIVE. Additionally, filter out events occurring strictly between 02:00 and 04:00 UTC on weekdays to align with standard maintenance windows.

• Scenario: Internal IT Service Desk Ticketing System (ServiceNow Agent or Jira Service Management)

  • Context: Enterprise service desk agents often run local C# desktop clients (e.g., the ServiceNow Desktop Agent) that perform background health checks and asset discovery. These tools frequently query the Windows Registry using COM interfaces to gather hardware/software inventory, triggering the typelibguid detection logic due to shared .NET framework dependencies.
  • Suggested Filter: Create an exclusion for process names SNDesktopAgent.exe, JiraServiceDeskAgent.exe, and their child processes. Further refine by excluding events where the UserAccount is a known service account (e.g., svc-itagent) rather than interactive user sessions.

• Scenario: Corporate Endpoint Protection Scans (CrowdStrike, SentinelOne, or Carbon Black)

  • Context: Next-generation EDR agents periodically scan for software vulnerabilities and configuration drift