Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLib GUIDs to establish persistence or execute reconnaissance within the Azure environment. Proactively hunting for these specific identifiers in Azure Sentinel is critical because standard logging often overlooks these tool signatures, allowing attackers to maintain a low-profile presence before escalating their activities.

YARA Rule

rule HKTL_NET_GUID_LimeLogger {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/LimeLogger"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "068d14ef-f0a1-4f9d-8e27-58b4317830c6" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGuid” rule, including suggested filters and exclusions:

Scenario: Microsoft Office Click-to-Run Background Updates
- Context: The OfficeClickToRun.exe process frequently loads C# assemblies containing specific TypeLib GUIDs during scheduled background updates or license validation checks. These GUIDs often overlap with those used by common red-team frameworks (like Cobalt Strike’s Beacon).
- Filter/Exclusion: Create an exclusion for the parent process OfficeClickToRun.exe running from the path C:\Program Files\Microsoft Office Root\VFS\.... Additionally, filter out events where the TypeLib GUID matches known Microsoft Office assembly hashes (e.g., GUIDs starting with 00020813).
Scenario: SCCM/MECM Application Deployment Agents
- Context: During business hours, the System Center Configuration Manager (SCCM) client (ccmexec.exe) executes C#-based deployment agents to install or update enterprise software. These agents often utilize standard .NET TypeLib GUIDs that mimic the signature of black-team reconnaissance tools.
- Filter/Exclusion: Exclude events where the parent process is ccmexec.exe and the command line contains arguments related to SoftwareCenter.exe or AppDeployment. You can also whitelist specific TypeLib GUIDs associated with the organization’s standard SCCM deployment packages.
Scenario: Scheduled PowerShell Health Monitoring Scripts
- Context: IT Operations teams often run scheduled tasks (Task Scheduler) that execute PowerShell scripts (powershell.exe) to check service health or disk usage. These scripts frequently load C# helper classes with TypeLib GUIDs identical to those used by red-team lateral movement tools.
- **Filter/