Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hypothesis posits that adversaries leverage C#-based red and black team tools with unique TypeLibGUID signatures to establish persistence or conduct reconnaissance within the environment. Proactive hunting for these specific identifiers in Azure Sentinel is essential to distinguish legitimate security tooling from malicious activity, ensuring early detection of potential lateral movement or command-and-control operations that may otherwise blend into routine administrative noise.

YARA Rule

rule HKTL_NET_GUID_ExploitRemotingService {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/tyranid/ExploitRemotingService"
        author = "Arnim Rupp"
        date = "2020-12-21"
    strings:
        $typelibguid0 = "fd17ae38-2fd3-405f-b85b-e9d14e8e8261" ascii nocase wide
        $typelibguid1 = "1850b9bb-4a23-4d74-96b8-58f274674566" ascii nocase wide
        $typelibguid2 = "297cbca1-efa3-4f2a-8d5f-e1faf02ba587" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://github.com/tyranid/ExploitRemotingService
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, along with suggested filters and exclusions:

• Scenario: Automated Backup Agent Execution

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik utilize C# components for their agent services. These agents frequently load specific TypeLib GUIDs during scheduled backup windows to communicate with the central console, mimicking the behavior of Red/Black team reconnaissance tools.
  • Filter/Exclusion: Exclude processes where ProcessName matches VeeamAgent.exe, rubrik-agent.exe, or RubrikService.exe running under the SYSTEM account during defined maintenance windows (e.g., 02:00–04:00).

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Context: The Microsoft SCCM (MECM) client performs routine inventory scans and software deployment tasks. Its C# based components often instantiate TypeLib GUIDs similar to those used by security assessment tools when querying hardware or registry states on endpoints.
  • Filter/Exclusion: Create a rule exception for ccmexec.exe and WmiPrvSE.exe processes initiated by the NT AUTHORITY\SYSTEM account, specifically filtering out TypeLib GUIDs associated with Microsoft’s internal management libraries (e.g., Microsoft.ConfigurationManagement).

• Scenario: Internal DevOps CI/CD Pipeline Agents

  • Context: In environments using Azure DevOps or Jenkins, build agents running on Windows servers execute C# scripts to compile code and run unit tests. These agents often load standard .NET TypeLibs that overlap with the signatures of Red Team tools like BloodHound or Lateral Movement