Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity involving C#-based red and black team tools by analyzing unique TypeLibGUID signatures often associated with offensive security utilities. Proactively hunting for these artifacts in Azure Sentinel is critical to distinguish legitimate security operations from potential malicious tool usage that may mimic standard administrative behavior.

YARA Rule

rule HKTL_NET_GUID_Minidump {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/3xpl01tc0d3r/Minidump"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "15c241aa-e73c-4b38-9489-9a344ac268a3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/3xpl01tc0d3r/Minidump
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scheduled Enterprise Backup Jobs

  • Scenario: Many enterprise backup solutions (e.g., Veeam, Commvault) utilize C# components to manage agent communication or perform local snapshots. These processes often load specific .NET assemblies that generate typelibguid entries identical to those used by red team tools like Cobalt Strike’s Beacon or Mimikatz during their initialization phase.
  • Filter/Exclusion: Create an exclusion for the backup service executable paths (e.g., C:\Program Files\Veeam\Backup and Replication\Server\Veeam.Backup.Service.exe) combined with a whitelist of known benign typelibguid values associated with these vendors.

• Microsoft Endpoint Configuration Manager (SCCM) Agent Tasks

  • Scenario: The SCCM Client (ccmexec.exe) frequently performs software inventory, compliance checks, and application deployments using C# scripts. When deploying new applications or running hardware inventories, the agent loads .NET libraries that trigger the same GUID signatures as black-team reconnaissance tools (e.g., BloodHound data collectors).
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe and the command line contains keywords such as /SoftwareInventory, /ApplicationDeployment, or specific SCCM task sequence IDs.

• Automated Patch Management Scans (e.g., WSUS or Intune)

  • Scenario: During scheduled patch windows, Windows Update agents or third-party tools like ManageEngine Patch Manager Plus execute C# based scanners to verify system readiness and dependency chains. These scans often instantiate .NET assemblies that mimic the behavior of red team lateral movement tools (e.g., SharpUp or SharpHound)