Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLib GUIDs to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific artifacts in Azure Sentinel is critical because their presence often indicates advanced tooling usage that may bypass standard signature-based detections, allowing analysts to identify both legitimate security operations and potential adversary activity early.

YARA Rule

rule HKTL_NET_GUID_nopowershell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/bitsadmin/nopowershell"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "555ad0ac-1fdb-4016-8257-170a74cb2f55" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/bitsadmin/nopowershell
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM or Intune

  • Context: Enterprise patch management systems (e.g., Microsoft Endpoint Configuration Manager or Intune) frequently utilize C# scripts to install updates. These scripts often instantiate standard .NET libraries that share the same TypelibGUID as common red-team tools like Cobalt Strike’s Beacon or Mimikatz when performing background service checks or registry modifications.
  • Suggested Filter: Exclude processes where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the command line contains keywords related to “deployment,” “update,” or specific patch package IDs.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Major endpoint protection suites (e.g., CrowdStrike, Symantec Endpoint Protection, or McAfee) run scheduled C# jobs to fetch and install new threat definitions. These background workers often load .NET assemblies that generate TypelibGUID signatures identical to those used by black-team reconnaissance tools like SharpUp or PowerView during their initial execution phase.
  • Suggested Filter: Create an exclusion for known antivirus service executables (e.g., CsAgent.exe, Symantec Endpoint Protection Client.exe) running under the context of scheduled tasks with names containing “Definition Update,” “Scan,” or “Engine Sync.”

• Scenario: Internal IT Asset Inventory Scans

  • Context: Organizations often run custom C# inventory agents (or commercial tools like Lansweeper or SolarWinds NCM) to collect hardware and software data. These agents enumerate the system registry and installed applications, triggering the same TypelibGUID events as red-team lateral movement