Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLibGUID values to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because it allows SOC teams to distinguish legitimate administrative activities from covert tool deployments often used during initial access phases, even when standard alerting thresholds are set low.

YARA Rule

rule HKTL_NET_GUID_PSByPassCLM {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/padovah4ck/PSByPassCLM"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "46034038-0113-4d75-81fd-eb3b483f2662" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/padovah4ck/PSByPassCLM
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters and exclusions:

• Scenario: Automated Patch Management Deployment

  • Context: Enterprise patch management solutions (e.g., Microsoft SCCM / Endpoint Configuration Manager or Ivanti) often utilize C# based agents to scan system health. These agents instantiate specific .NET libraries that match the typelibguid signatures of common red team tools like Cobalt Strike or Beacon.
  • Filter/Exclusion: Create a whitelist for processes running under the context of known patch management services (e.g., ccmexec.exe, IvAntiMalware.exe) and exclude any network connections originating from these parent process IDs.

• Scenario: Scheduled Backup and Integrity Verification Jobs

  • Context: Internal IT operations frequently run scheduled PowerShell scripts or C# applications to verify file integrity or manage backups (e.g., using Veeam Agent for Windows or custom Azure Automation Runbooks). These tools often load the same .NET assemblies used by blue team monitoring agents, triggering the typelibguid match.
  • Filter/Exclusion: Exclude events where the parent process is a scheduled task (svchost.exe with specific service names like Schedule) or known backup executables (e.g., VeeamAgentService.exe). Additionally, filter by time-of-day to exclude activity occurring during off-hours maintenance windows.

• Scenario: Endpoint Detection and Response (EDR) Self-Scanning

  • Context: The organization’s primary EDR solution (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) performs continuous behavioral analysis. These agents frequently spawn C# helper processes to analyze memory structures,