Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that expose unique TypeLibGUID artifacts to evade standard signature-based detection. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because it enables the SOC team to identify stealthy reconnaissance or post-exploitation activities that often bypass traditional endpoint security controls due to their low severity classification.

YARA Rule

rule HKTL_NET_GUID_Salsa_tools {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Hackplayers/Salsa-tools"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "276004bb-5200-4381-843c-934e4c385b66" ascii nocase wide
        $typelibguid1 = "cfcbf7b6-1c69-4b1f-8651-6bdb4b55f6b9" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/Hackplayers/Salsa-tools
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters and exclusions:

• Scenario: Automated Deployment Pipelines (Azure DevOps / GitHub Actions)

  • Context: CI/CD agents running on build servers frequently execute C# compilation tasks, unit tests, or deployment scripts that instantiate standard .NET assemblies. These processes often generate typelibguid entries associated with common Red Team tooling libraries (e.g., SharpSploit, Covenant) even when no actual attack simulation is occurring.
  • Filter/Exclusion: Exclude the specific Service Account used by the CI/CD runner (e.g., svc-build-agent) and restrict detection to non-standard execution paths. Filter out events where the parent process is msbuild.exe, dotnet.exe, or AzureDevOpsAgentService.exe.

• Scenario: Endpoint Protection Scanning (CrowdStrike / SentinelOne)

  • Context: Next-generation EDR solutions often perform deep behavioral analysis by injecting C# modules into running processes to monitor memory and registry changes. This injection mechanism can trigger the rule’s typelibguid signature, mimicking the footprint of a Red Team tool like BloodHound or SharpUp.
  • Filter/Exclusion: Create an exclusion for known EDR service executables (e.g., C:\Program Files\CrowdStrike\csagent.exe, SentinelOne\S1Agent.exe). Additionally, filter out events where the process command line contains specific flags related to “health check,” “scan,” or “update.”

• Scenario: Scheduled Group Policy Updates

  • Context: Enterprise environments often utilize scheduled tasks (Task Scheduler) to push configuration updates or run compliance checks using C#-based management tools. A recurring job running a script