Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that generate unique typelibguid artifacts to evade standard signature-based detection. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because they often indicate early-stage reconnaissance or post-exploitation tool deployment that may not yet trigger high-severity alerts but could signal a sophisticated threat actor’s presence.

YARA Rule

rule HKTL_NET_GUID_UAC_Escaper {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/UAC-Escaper"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "95359279-5cfa-46f6-b400-e80542a7336a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/NYAN-x-CAT/UAC-Escaper
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Patch Management Deployment (Microsoft Endpoint Configuration Manager)

  • Context: The SCCM client service (ccmexec.exe) or associated deployment agents frequently load .NET assemblies containing specific TypelibGUIDs when executing software updates or inventory scans. These GUIDs often overlap with those used by security assessment tools because they share common C# base libraries (e.g., Microsoft.Deployment).
  • Suggested Filter: Exclude the process path C:\Program Files\Microsoft Configuration Manager\Client\ccmexec.exe and its child processes from triggering this rule. Additionally, filter out events where the ParentImage is svchost.exe running under the AppVClient or SMSAgentHost service accounts during standard maintenance windows (e.g., 02:00–06:00).

• Scenario: Enterprise Backup and Recovery Operations (Veeam Backup & Replication)

  • Context: Veeam’s backup proxies utilize C# based components to manage repository connections and perform integrity checks. The Veeam.Backup.Service.exe process often registers or interacts with COM libraries that generate the same TypelibGUIDs flagged as “Red/Black team” indicators, particularly when initializing new backup jobs or performing agent health checks.
  • Suggested Filter: Create an exclusion for the image path C:\Program Files\Veeam\Backup and Replication\Server\Bin\Veeam.Backup.Service.exe. Furthermore, exclude events where the CommandLine contains arguments related to scheduled tasks (e.g., -scheduled, -jobId) rather than interactive tool execution.

• Scenario: Internal Compliance Scanning via PowerShell Scripts *