Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging C#-based red and black team tools within the environment to establish persistence or conduct reconnaissance, identifiable by unique typelibguid artifacts in process execution logs. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because it allows the SOC team to distinguish between authorized security operations and malicious tool usage that may otherwise blend into standard background noise due to its low severity classification.

YARA Rule

rule HKTL_NET_GUID_Simple_Loader {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/cribdragg3r/Simple-Loader"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "035ae711-c0e9-41da-a9a2-6523865e8694" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/cribdragg3r/Simple-Loader
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGuid rule, along with suggested filters or exclusions:

• Scenario: Automated Patch Deployment via SCCM/MECM

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) frequently loads C# assemblies containing specific TypelibGUIDs during scheduled software updates, driver installations, or compliance scans. These GUIDs often match known Red Team tool signatures because they share common .NET libraries used by security vendors.
  • Filter/Exclusion: Exclude the process path C:\Windows\CCM\CcmExec.exe and its child processes from the alert logic when the parent process is ccmexec.exe. Additionally, whitelist the specific TypelibGUIDs associated with Microsoft Configuration Manager components if they are consistently flagged.

• Scenario: Endpoint Detection and Response (EDR) Self-Scanning

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon Sensor, SentinelOne Agent, or Carbon Black) perform continuous background scanning using C# modules to analyze file integrity and memory states. These internal scanning engines often instantiate the same TypelibGUIDs that the rule flags as external Red Team tools (like Cobalt Strike’s Beacon or Empire).
  • Filter/Exclusion: Create a whitelist for known EDR sensor processes (e.g., C:\Program Files\CrowdStrike\fs.exe, C:\Program Files\SentinelOne\SentinelAgent\agent.exe). Configure the rule to suppress alerts originating from these specific process paths, assuming the EDR vendor’s internal tools are trusted.

• Scenario: Scheduled PowerShell Reporting and Compliance Jobs

  • Context: IT Operations teams run scheduled tasks (via Task Scheduler) that execute PowerShell scripts (`powershell.exe