Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based Red and Black team tools that expose unique typelibguid identifiers during execution within the Azure environment. Proactively hunting for these specific GUIDs allows the SOC team to distinguish legitimate security tooling from potential adversary activity, ensuring early visibility into reconnaissance or post-exploitation phases even when initial alert severity is low.

YARA Rule

rule HKTL_NET_GUID_UAC_SilentClean {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/EncodeGroup/UAC-SilentClean"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "948152a4-a4a1-4260-a224-204255bfee72" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/EncodeGroup/UAC-SilentClean
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule in an enterprise environment:

• Microsoft Endpoint Configuration Manager (SCCM) Application Deployment

  • Scenario: The SCCM client service (ccmexec.exe) or its associated deployment agents frequently instantiate .NET assemblies to deploy software updates. These deployments often utilize specific TypelibGUIDs that overlap with known Red Team frameworks (e.g., SharpUp or similar C# injection tools) because they share common base libraries like System.Management.Automation.
  • Filter/Exclusion: Create an exclusion rule for processes originating from the SCCM installation directory (C:\Program Files\Microsoft Configuration Manager\Client) and specifically filter out ccmexec.exe parent processes when the loaded assembly hash matches known Microsoft-signed binaries.

• Scheduled PowerShell Automation Jobs (Task Scheduler)

  • Scenario: Enterprise IT operations rely heavily on scheduled tasks running complex PowerShell scripts for inventory, patching, or log rotation. These scripts often load C# helper classes that generate TypelibGUIDs identical to those used by Red Team tools like SharpHound or Bloodhound. If the script is run under a high-privilege service account (e.g., DOMAIN\svc_backup), it may trigger the rule despite being benign.
  • Filter/Exclusion: Exclude events where the parent process is TaskScheduler.exe and the command line contains standard PowerShell flags (-File, -NoProfile) targeting known internal script paths (e.g., C:\Scripts\Operations\). Additionally, whitelist specific TypelibGUIDs associated with Microsoft-signed assemblies.

• Microsoft Office Click-to-Run Updates

  • Scenario: The background update service for Microsoft Office (OfficeClickToRun.exe) performs regular integrity checks and feature installations