Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these indicators is essential to distinguish legitimate security testing from malicious reconnaissance or early-stage tool deployment that may otherwise evade standard signature-based detections.

YARA Rule

rule HKTL_NET_GUID_SharpGPO_RemoteAccessPolicies {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/FSecureLABS/SharpGPO-RemoteAccessPolicies"
        author = "Arnim Rupp"
        date = "2020-12-21"
    strings:
        $typelibguid0 = "fbb1abcf-2b06-47a0-9311-17ba3d0f2a50" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/FSecureLABS/SharpGPO-RemoteAccessPolicies
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID,” including suggested filters and exclusions:

• Scenario: Automated Backup Verification Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize C# agents to verify database integrity or scan file systems. These agents may instantiate specific COM objects with TypelibGUID signatures that overlap with security tooling libraries used by Red/Black teams.
  • Suggested Filter: Exclude processes where the parent executable is a known backup service (e.g., vbrsvc.exe, ctfmon.exe) and the file path resides within the vendor’s installation directory (e.g., C:\Program Files\Veeam\Backup & Replication\).

• Scenario: Scheduled .NET Framework Updates or Health Checks

  • Context: Windows Update services or custom IT health check scripts running via Task Scheduler often load C# assemblies to query system state. These tasks may trigger the detection logic by registering temporary type libraries that match the rule’s GUID signatures during execution windows (e.g., 2:00 AM daily).
  • Suggested Filter: Create a time-based exclusion for events occurring between 01:30 and 04:30 on weekdays, specifically filtering out processes with names containing “Microsoft.Update” or “HealthCheckAgent” running under the SYSTEM account.

• Scenario: Development Environment Build Agents (CI/CD)

  • Context: In hybrid environments where build servers (e.g., Azure DevOps Agents, Jenkins) are co-located with production workstations, automated build pipelines execute C# compilation tools. These agents frequently generate TypelibGUID events during the “restore” or “build” phases that mimic Red Team tool behavior.