Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule hypothesizes that adversaries are executing C#-based red or black team reconnaissance and exploitation tools within the environment, identifiable by unique TypeLib GUID signatures embedded in their processes. Proactive hunting for these specific artifacts is critical to distinguish legitimate security operations from malicious activity masquerading as standard tooling, thereby reducing false positives and enhancing visibility into advanced threat behaviors.

YARA Rule

rule HKTL_NET_GUID_SharpBypassUAC {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/FatRodzianko/SharpBypassUAC"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "0d588c86-c680-4b0d-9aed-418f1bb94255" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters and exclusions:

Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Updates
- Context: The SCCM client service (ccmexec.exe) frequently loads C# assemblies containing specific TypeLib GUIDs during scheduled hardware inventory scans or software deployment tasks. These internal tools often mimic the signature of red-team reconnaissance utilities because they enumerate system components extensively.
- Suggested Filter/Exclusion: Create an exclusion for process names ccmexec.exe and WmiPrvSE.exe when originating from the trusted installation path C:\Program Files\Microsoft Configuration Manager\Client. Additionally, filter out events where the parent process is TfsBuildAgent.exe or SMS_EXECUTIVE to capture legitimate deployment pipelines.
Scenario: Automated .NET Framework Health Checks
- Context: Enterprise environments often run scheduled PowerShell jobs (e.g., via Task Scheduler) that utilize C# libraries like System.Management.Automation to verify .NET runtime versions and registry integrity. These scripts invoke TypeLib GUIDs associated with standard Microsoft diagnostics, which the rule may flag as active black-team enumeration tools.
- Suggested Filter/Exclusion: Exclude events where the command line contains known diagnostic flags (e.g., --health-check, /verify) or originates from a specific scheduled task name such as “Microsoft .NET Framework Health Monitor.” You can also whitelist TypeLib GUIDs belonging to standard Microsoft namespaces (e.g., {01438A75-5D3B-4E2C-9F...}) that are distinct from known red-team tool signatures.
Scenario: Visual Studio Team Services (Azure DevOps) Build Agents
- **Context