Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that generate distinct typelibguid artifacts to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel is critical because low-severity detections may otherwise be overlooked, allowing attackers to maintain a stealthy foothold before escalating their activities.

YARA Rule

rule HKTL_NET_GUID_LOLBITS {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Kudaes/LOLBITS"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "29d09aa4-ea0c-47c2-973c-1d768087d527" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/Kudaes/LOLBITS
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM or Intune

  • Context: Enterprise deployment agents (e.g., Microsoft Endpoint Configuration Manager or Microsoft Intune) frequently utilize C# based installers to push updates. These tools often instantiate .NET libraries that share the same typelibguid as known red-team frameworks like Cobalt Strike’s Beacon or specific PowerShell execution engines during package installation and inventory scans.
  • Suggested Filter/Exclusion: Create an exclusion for processes running under the context of deployment service accounts (e.g., NT SERVICE\ccmexec, Microsoft.Inc.IntuneManagement) originating from trusted parent paths such as C:\Program Files\Microsoft Intune Management Extension or C:\Windows\CCM.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Legacy backup solutions (e.g., Veeam Agent, Commvault) often rely on C# wrappers to manage file system indexing and compression. When these scheduled jobs run during off-hours, they may load specific .NET type libraries that match the GUIDs associated with black-team reconnaissance tools, particularly those involving file enumeration and network socket creation.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is a known backup service (e.g., VeeamAgent.exe, cvp.exe) and the execution time aligns with established maintenance windows defined in the enterprise calendar.

• Scenario: Internal IT Support & Patch Management Tools

  • Context: Custom internal C# applications developed by the IT operations team for remote assistance or patch verification often reuse standard .NET libraries. These tools may trigger the rule when performing system health checks that involve loading specific