Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C# Red/Black team tools that register unique TypeLib GUIDs in the Windows registry to establish persistence or execute custom payloads. Proactively hunting for these specific artifacts in Azure Sentinel is critical because they often indicate early-stage reconnaissance or post-exploitation tooling that may evade standard signature-based detections due to their low-severity, legitimate appearance.

YARA Rule

rule HKTL_NET_GUID_DarkEye {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/K1ngSoul/DarkEye"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "0bdb9c65-14ed-4205-ab0c-ea2151866a7f" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/K1ngSoul/DarkEye
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the HKTL_NET detection rule, focusing on legitimate enterprise activities involving C# Red/Black team tools identified via typelibguid:

• Automated Patch Management Deployment (Microsoft SCCM/MECM)

  • Scenario: During scheduled maintenance windows, the System Center Configuration Manager (SCCM) client service (ccmexec.exe) or its associated update agents instantiate .NET assemblies to verify patch compliance. These processes often load standard Red Team libraries (e.g., System.Management.Automation or specific Microsoft diagnostic DLLs) that share common typelibguid signatures with known offensive tools, triggering the rule during routine inventory scans.
  • Filter/Exclusion: Create an exclusion for the parent process name ccmexec.exe and its child processes running under the SYSTEM account within the C:\Windows\CCM\ directory path.

• Enterprise Endpoint Protection Scans (CrowdStrike or SentinelOne)

  • Scenario: Next-generation antivirus engines frequently utilize C#-based behavioral analysis modules to scan for memory injection techniques. When these security agents perform deep scans on the HKLM\Software\Classes\TypeLib registry keys, they may load internal detection libraries that mimic the GUID structures of Red Team tools (like Cobalt Strike or Empire) used by the Blue team’s own defense mechanisms.
  • Filter/Exclusion: Exclude events where the process image path matches known EDR executables (e.g., C:\Program Files\CrowdStrike\csagent.exe or SentinelOne\SentinelAgent.exe) and the user context is a dedicated service account (e.g., NT SERVICE\CSAgent).

• Scheduled PowerShell Compliance Audits

  • Scenario: IT Operations teams often run scheduled Task Scheduler jobs using PowerShell to audit registry configurations. These scripts frequently