Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that expose unique TypeLibGUID artifacts to evade standard signature-based detection. Proactively searching for these specific GUIDs in Azure Sentinel allows the SOC team to identify stealthy reconnaissance or post-exploitation activities before they escalate into critical incidents, despite the rule’s current low severity classification.

YARA Rule

rule HKTL_NET_GUID_HideFromAMSI {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0r13lc0ch4v1/HideFromAMSI"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "b91d2d44-794c-49b8-8a75-2fbec3fe3fe3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/0r13lc0ch4v1/HideFromAMSI
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, along with suggested filters or exclusions:

• Scenario: Automated Patch Management Deployment (SCCM/Microsoft Endpoint Configuration Manager)

  • Context: During scheduled maintenance windows, the SCCM client service (ccmexec.exe) or the Software Center application executes C#-based deployment agents to install updates. These tools often instantiate specific .NET assemblies that generate typelibguid entries matching known red/black team signatures (e.g., Microsoft.Management.Infrastructure).
  • Suggested Filter: Exclude processes where the parent process is ccmexec.exe or SoftwareCenter.exe AND the file path starts with C:\Windows\CCM\ or C:\Program Files (x86)\Microsoft Configuration Manager.

• Scenario: Enterprise Antivirus Real-Time Scanning

  • Context: Major endpoint protection solutions (e.g., CrowdStrike Falcon, Symantec Endpoint Protection, or Microsoft Defender) frequently utilize C# components for their management consoles and policy enforcement engines. When these services scan specific file types or update their definitions, they may load libraries that trigger the rule’s GUID detection logic, mimicking a red-team reconnaissance tool.
  • Suggested Filter: Create an exclusion for known antivirus service names (e.g., C:\Program Files\CrowdStrike\csagent.exe, C:\Program Files\Symantec Endpoint Protection\SmcGui.exe) and exclude any typelibguid events originating from these specific process IDs.

• Scenario: Scheduled PowerShell Automation Jobs

  • Context: IT Operations teams often run scheduled PowerShell scripts (via Task Scheduler) to perform user provisioning, log rotation, or compliance checks. These scripts frequently invoke C# compiled modules or use the System.Management.Automation