Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt identifies adversary activity involving C#-based red and black team tools by analyzing unique TypeLibGUID artifacts that often indicate reconnaissance or post-exploitation tooling within the environment. Proactively hunting for these signatures in Azure Sentinel is critical to distinguish legitimate security operations from potential malicious tool deployment, ensuring early visibility into sophisticated threat actor behaviors before they escalate.

YARA Rule

rule HKTL_NET_GUID_RedSharp {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/padovah4ck/RedSharp"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "30b2e0cf-34dd-4614-a5ca-6578fb684aea" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/padovah4ck/RedSharp
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects c# red/blue-team tools via typelibguid rule, tailored for an enterprise environment:

• Scenario: Automated Patch Deployment via SCCM/MECM

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) frequently loads C# assemblies during software update deployments. These deployments often utilize internal management agents or third-party patching tools that register specific TypeLib GUIDs to manage installation states and reporting.
  • Filter/Exclusion: Create an exclusion for the process path C:\Windows\CCM\* (or specifically ccmexec.exe) when the parent process is SmsHostService. Additionally, exclude known internal SCCM TypeLib GUIDs identified during a baseline scan of the patching infrastructure.

• Scenario: Microsoft Teams Background Updates

  • Context: In an enterprise setting, Microsoft Teams runs as a persistent background service for all users. The application utilizes C# components for its update mechanism (TeamsUpdate.exe or TeamsProcess.exe) which registers TypeLib GUIDs to handle version checks and silent updates without user interaction. This activity is often misidentified as a security tool scanning the environment.
  • Filter/Exclusion: Exclude processes with the image path containing \Microsoft\Teams\Current\* where the process name matches TeamsUpdate.exe or TeamsProcess.exe. Whitelist the specific TypeLib GUIDs associated with the Microsoft Teams update engine (e.g., {0F2E1C...}).

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites (such as CrowdStrike Falcon, Carbon Black, or Symantec) often run scheduled jobs to fetch and install definition updates. These agents are heavily built on C# frameworks and instantiate specific TypeLib GUIDs