Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for specific TypeLibGUID signatures associated with known C# red and black team reconnaissance or attack tools within Azure Sentinel environments. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate security testing operations and malicious tool usage, ensuring that low-severity signals are not overlooked during broader threat investigations.

YARA Rule

rule HKTL_NET_GUID_Snaffler {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/SnaffCon/Snaffler"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "2aa060b4-de88-4d2a-a26a-760c1cefec3e" ascii nocase wide
        $typelibguid1 = "b118802d-2e46-4e41-aac7-9ee890268f8b" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/SnaffCon/Snaffler
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID,” along with suggested filters or exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Azure DevOps, Jenkins) running on Windows hosts frequently invoke C# utilities like dotnet CLI tools or custom build scripts that load specific .NET assemblies. These tools often generate unique TypeLibGUIDs during compilation and testing phases that mimic Red/Black team reconnaissance signatures.
  • Filter/Exclusion: Exclude processes running under the context of known CI/CD service accounts (e.g., NT SERVICE\TeamFoundationBuildAgent) or filter by process path patterns containing \AzureDevOps\ or \Jenkins\.

• Scenario: Enterprise Endpoint Management & Patching

  • Context: Tools like Microsoft Intune, SCCM (System Center Configuration Manager), or Ivanti utilize C# agents to scan inventory and deploy patches. The ccmexec.exe or similar agent processes often instantiate .NET components with TypeLibGUIDs that overlap with security tool signatures during scheduled maintenance windows.
  • Filter/Exclusion: Create an exclusion for the process name ccmexec.exe, IntuneAgent.exe, and IvantiAgent.exe when executed by the SYSTEM or specific domain service accounts (e.g., DOMAIN\SCCM-Service).

• Scenario: Scheduled Backup and Data Archiving Jobs

  • Context: Enterprise backup solutions such as Veeam, Commvault, or Acronis often employ C# wrappers to manage metadata and reporting. During scheduled nightly jobs, these tools load libraries that trigger the detection logic due to shared .NET framework dependencies used by both backup software and Red/Black team tools.
  • **Filter