Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for C# Red and Black team tools that register unique TypeLibGUIDs within the environment. Proactive hunting is essential to distinguish legitimate security tooling from malicious reconnaissance or lateral movement attempts that mimic known utility signatures in Azure Sentinel.

YARA Rule

rule HKTL_NET_GUID_Tokenvator {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xbadjuju/Tokenvator"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "4b2b3bd4-d28f-44cc-96b3-4a2f64213109" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/0xbadjuju/Tokenvator
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule Detects c# red/black-team tools via typelibguid, including recommended filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize C# agents that register specific TypeLib GUIDs during scheduled nightly jobs to manage data replication or snapshot creation. These legitimate background processes can mimic the behavior of Red Team tools like SharpUp or PowerSploit.
  • Filter/Exclusion: Exclude processes running under the context of known backup service accounts (e.g., VeeamBackupService, CommvaultAgent) and filter by specific TypeLib GUIDs associated with these vendors. Alternatively, add a time-based exclusion for the standard maintenance window (e.g., 02:00–04:00).

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Context: The SCCM Client (ccmexec.exe) frequently invokes C# components to deploy software updates or run compliance scripts. These operations often involve COM registration that triggers the TypeLib GUID detection, resembling tools like SharpHunt or custom audit scripts used by security teams.
  • Filter/Exclusion: Create an exclusion for the process name ccmexec.exe when it is initiated by the System account or specific SCCM service accounts. Additionally, filter out events where the parent process is wuauserv.exe (Windows Update) to distinguish between update activities and security tool execution.

• Scenario: Internal DevOps CI/CD Pipeline Artifacts

  • Context: In environments with internal development teams, Azure DevOps or Jenkins agents running on build servers often execute C# test suites or deployment scripts that register TypeLib GUIDs. These legitimate builds can be flagged