Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging C#-based red and black team tools to execute reconnaissance or post-exploitation activities, identifiable by unique TypeLibGUID signatures within process execution logs. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because low-severity detections often indicate early-stage tool usage that may precede more impactful malicious actions if left uninvestigated.

YARA Rule

rule HKTL_NET_GUID_Lime_Downloader {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/Lime-Downloader"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "ec7afd4c-fbc4-47c1-99aa-6ebb05094173" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/NYAN-x-CAT/Lime-Downloader
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGuid rule, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM or Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager frequently utilizes C# based deployment agents to install updates. These agents often instantiate COM objects with specific typelibguid values that overlap with known red-team reconnaissance tools during the installation phase of enterprise applications.
  • Filter/Exclusion: Create an exclusion for processes originating from C:\Windows\CCM\* (SCCM) or C:\Program Files\Microsoft Intune Management Extension\*. Additionally, filter by parent process names such as ccmexec.exe, IntuneManagementExtension.exe, or msiexec.exe to allow legitimate deployment activities.

• Scenario: Scheduled PowerShell Health Checks and Reporting

  • Context: Enterprise IT teams often run scheduled tasks (Task Scheduler) that execute custom C# scripts or PowerShell wrappers to generate system health reports, audit compliance logs, or check disk space. These scripts may load .NET assemblies with typelibguid signatures identical to those used by black-team enumeration tools like BloodHound or SharpHound.
  • Filter/Exclusion: Exclude processes launched by the Windows Task Scheduler service (svchost.exe with image path containing \System32\Tasks) where the command line contains specific keywords related to internal reporting (e.g., HealthCheck, ComplianceReport). Whitelist known internal script paths located in C:\Scripts\Enterprise\*.

• Scenario: Microsoft Office 365 ProPlus Background Updates

  • Context: The Office Click-to-Run service and the Office Background Task Handler (`OfficeClickToRun.exe