Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary use of C#-based red and black team tools by analyzing unique TypeLibGUID artifacts often associated with known security utilities or custom malware loaders. Proactively hunting for these signatures in Azure Sentinel is essential to distinguish legitimate operational tooling from stealthy adversary presence, ensuring that low-severity indicators are not overlooked during initial reconnaissance phases.

YARA Rule

rule HKTL_NET_GUID_LimeUSB_Csharp {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/LimeUSB-Csharp"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "94ea43ab-7878-4048-a64e-2b21b3b4366d" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/NYAN-x-CAT/LimeUSB-Csharp
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects c# red/blue-team tools via typelibguid rule, including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/MECM

  • Context: System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager frequently executes C#-based deployment agents (ccmexec.exe spawning child processes like WmiPrvSE.exe or custom .exe wrappers). These tools often load specific TypeLib GUIDs associated with the Microsoft .NET Framework or proprietary management libraries during scheduled patch windows (e.g., Tuesday 2:00 AM – 6:00 AM) across all domain-joined workstations.
  • Filter/Exclusion: Create a filter to exclude events where the ParentProcessName is ccmexec.exe or WmiPrvSE.exe and the execution time falls within the defined maintenance window (e.g., 02:00–06:00 local time). Alternatively, whitelist the specific TypeLib GUIDs associated with the SCCM agent version currently deployed in the environment.

• Scenario: Scheduled Antivirus Real-Time Scanning

  • Context: Enterprise Endpoint Detection and Response (EDR) or Antivirus solutions (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) utilize C# components for real-time scanning hooks. When these agents scan large directories or perform heuristic analysis on .NET applications, they instantiate COM objects that register specific TypeLib GUIDs. This activity is continuous but spikes during scheduled deep scans or definition updates.
  • Filter/Exclusion: Exclude events originating from known security vendor process names (e.g., csfalcon.exe, SentinelOneAgent.exe, MsMpEng.exe). Additionally, filter out TypeLib GUIDs that are static and belong