Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based Red and Black team tools that expose unique typelibguid identifiers to establish a baseline of legitimate tooling activity within the environment. Proactively hunting for these artifacts in Azure Sentinel is critical because it enables the SOC to distinguish between authorized security operations and potential adversary use of custom or modified C# utilities that may otherwise evade standard signature-based detection.

YARA Rule

rule HKTL_NET_GUID_ESC {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NetSPI/ESC"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "06260ce5-61f4-4b81-ad83-7d01c3b37921" ascii nocase wide
        $typelibguid1 = "87fc7ede-4dae-4f00-ac77-9c40803e8248" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/NetSPI/ESC
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters and exclusions:

• Automated Patch Deployment via SCCM/Microsoft Endpoint Configuration Manager

  • Scenario: The System Center Configuration Manager (SCCM) client agent (ccmexec.exe) or the Application Enforcement service executes C#-based deployment packages. These tools often instantiate COM objects with specific TypelibGUIDs to manage software updates, which can mimic the behavior of red-team reconnaissance tools scanning for installed applications.
  • Filter/Exclusion: Create an exclusion rule that filters out events where the process name is ccmexec.exe, CcmExec.exe, or AppEnforce.exe AND the parent process is svchost.exe (specifically the AppVClient or Wuauserv service). Additionally, exclude known SCCM deployment package GUIDs found in the enterprise asset inventory.

• Scheduled Backup and Integrity Checks by Veeam or Commvault

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault utilize C# components for their “Guest Agent” services to perform integrity checks, mount virtual disks, and manage snapshots. These agents frequently load type libraries with GUIDs that overlap with those used by security assessment tools (e.g., mimicking PowerShell or custom .NET auditing scripts).
  • Filter/Exclusion: Exclude events originating from the specific service executables: VeeamAgent.exe, vbragent.exe, or simproxy.exe. Furthermore, filter for scheduled task triggers occurring during standard maintenance windows (e.g., 02:00–06:00 local time) where these backup jobs are known to run.

• **Internal IT Service Management (ITSM) and