Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt identifies the execution of C#-based red and black team tools by analyzing unique TypeLibGUID values often embedded in legitimate security utilities. Proactively hunting for these artifacts in Azure Sentinel is essential to distinguish authorized testing activities from potential adversary use of similar tooling, ensuring that low-severity signals are not overlooked during initial threat assessments.

YARA Rule

rule HKTL_NET_GUID_StormKitty {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/LimerBoy/StormKitty"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "a16abbb4-985b-4db2-a80c-21268b26c73d" ascii nocase wide
        $typelibguid1 = "98075331-1f86-48c8-ae29-29da39a8f98b" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/LimerBoy/StormKitty
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID” in an enterprise environment, along with suggested filters:

• Scenario: Automated Backup and Maintenance Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or custom PowerShell/C# maintenance scripts often utilize C# libraries to interact with Windows Management Instrumentation (WMI). These tools may instantiate specific typelibguid values associated with standard .NET assemblies used for system health checks, which overlap with the GUIDs monitored by red team frameworks.
  • Suggested Filter: Exclude processes running under the context of known backup service accounts (e.g., DOMAIN\svc_backup) or restrict detection to specific parent process names like Veeam.Backup.Service.exe and PowerShell.exe when launched from a scheduled task path (C:\Windows\System32\Tasks\).

• Scenario: Software Deployment via SCCM/MECM

  • Context: During application deployment cycles, the Microsoft Endpoint Configuration Manager (formerly SCCM) client agent executes C#-based installers and configuration tools. These agents frequently load COM libraries with typelibguid signatures that mimic those used by reconnaissance or lateral movement tools in red team engagements, particularly during software inventory scans.
  • Suggested Filter: Create an exclusion for the parent process ccmexec.exe (the core SCCM agent) and its child processes (CcmExec\Microsoft.ConfigurationManager.SCCMClient.exe). Additionally, filter by the specific user context of the deployment service account (e.g., DOMAIN\SysAdmin_Deploy).

• Scenario: Endpoint Detection and Response (EDR) Self-Scanning

  • Context: Modern EDR agents (such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Sentinel