Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging custom C# Red/Black team tools within the environment, identifiable by unique TypeLibGUID artifacts often associated with specialized security utilities. Proactive hunting for these signatures in Azure Sentinel is critical to distinguish legitimate internal tooling from potential adversary persistence mechanisms or lateral movement activities masquerading as standard administrative operations.

YARA Rule

rule HKTL_NET_GUID_Lime_Crypter {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/Lime-Crypter"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "f93c99ed-28c9-48c5-bb90-dd98f18285a6" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/NYAN-x-CAT/Lime-Crypter
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters and exclusions:

• Automated Patch Management Scans

  • Scenario: Enterprise patch management solutions like Microsoft Endpoint Configuration Manager (SCCM) or Ivanti utilize C# agents to perform hardware inventory scans. These agents often instantiate COM objects with specific typelibguid values that match known Red/Blue team tool signatures during routine daily scanning windows.
  • Filter/Exclusion: Exclude processes originating from the vendor’s installation directory (e.g., C:\Program Files\Microsoft Configuration Manager) and filter by parent process names such as ccmexec.exe or IvantiAgentService.

• Scheduled Backup Verification Jobs

  • Scenario: Enterprise backup suites like Veeam Backup & Replication or Commvault run scheduled C# verification tasks that validate disk integrity and snapshot consistency. These background jobs frequently load .NET assemblies with GUIDs overlapping with security tool libraries to interact with the Windows Volume Shadow Copy Service (VSS).
  • Filter/Exclusion: Create an exclusion for specific typelibguid values associated with the backup vendor’s known assembly versions, restricted to execution times matching the organization’s maintenance window (e.g., 02:00 – 04:00 UTC) and parent process VeeamAgent.exe.

• IT Asset Discovery and Compliance Audits

  • Scenario: Internal IT asset discovery tools or compliance auditors, such as ServiceNow Discovery Agent or Tenable Nessus, deploy C# modules to query system configurations. These agents often trigger the rule when they enumerate installed software and registry keys using standard .NET interop libraries that share GUIDs with defensive security tooling.