Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based Red and Black team tools that can be uniquely identified by their specific TypeLibGUID values within process execution logs. Proactively hunting for these signatures in Azure Sentinel is essential to distinguish legitimate security operations from malicious activity masquerading as standard administrative tooling, thereby reducing false negatives during early-stage threat detection.

YARA Rule

rule HKTL_NET_GUID_Adamantium_Thief {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/LimerBoy/Adamantium-Thief"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "e6104bc9-fea9-4ee9-b919-28156c1f2ede" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/LimerBoy/Adamantium-Thief
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Patch Management Deployment

  • Context: Enterprise patch management systems (e.g., Microsoft Endpoint Configuration Manager (MECM) or Ivanti) frequently execute C# based deployment agents that instantiate COM objects to verify software integrity. These agents often utilize specific TypelibGUIDs associated with standard .NET framework libraries used by the tooling vendor, which can be mistaken for a Red Team “living off the land” (LOTL) execution attempt.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Parent Process Name (ccmexec.exe or IvantiAgent.exe) and restrict the alert to only trigger if the TypelibGUID is not in a known “trusted infrastructure” list (e.g., exclude GUIDs associated with Microsoft Office, .NET Framework Core, and specific vendor libraries).

• Scenario: Scheduled Backup Verification Jobs

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault run scheduled C# scripts during off-hours to verify backup chain integrity. These jobs often load custom COM components via TypelibGUID to interact with storage APIs, mimicking the behavior of a Black Team tool performing reconnaissance on data repositories.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for known scheduled job windows (e.g., 02:00–06:00) combined with an Account Exclusion targeting dedicated service accounts used by the backup infrastructure (e.g., svc-veeam-backup, DOMAIN\BackupService).

• Scenario: Endpoint Detection and Response (EDR) Self-Monitoring