Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection rule identifies the execution of C#-based Red and Black team security tools by analyzing unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these artifacts is essential to distinguish legitimate security operations from potential adversary activity that mimics tooling behavior to evade standard threat detection mechanisms.

YARA Rule

rule HKTL_NET_GUID_SharpWifiGrabber {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/r3nhat/SharpWifiGrabber"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "c0997698-2b73-4982-b25b-d0578d1323c2" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/r3nhat/SharpWifiGrabber
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid”, including targeted filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: A build server (e.g., Jenkins or Azure DevOps) running a C# compilation task triggers the msbuild.exe process, which instantiates COM objects with specific TypeLibGUIDs often associated with security testing frameworks. This mimics the behavior of Red Team tools like Cobalt Strike or BloodHound.
  • Filter/Exclusion: Exclude processes running under the Jenkins or VSTS service accounts where the parent process is java.exe (for Jenkins) or AgentWorker.exe, and restrict detection to non-build-server IP ranges.

• Scenario: Scheduled Backup and Inventory Scans

  • Context: Enterprise backup solutions like Veeam Backup & Replication or inventory tools like LanDesk utilize C# components to query system registries and COM interfaces during nightly scheduled jobs. These tools generate TypeLibGUIDs that overlap with Black Team monitoring agents (e.g., Sysmon or Carbon Black).
  • Filter/Exclusion: Create an exclusion for known backup service accounts (e.g., NT SERVICE\VeeamTransport) and filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 local time) on the asset inventory list.

• Scenario: Endpoint Protection Health Checks

  • Context: The native health check service of an EDR solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically runs diagnostic scripts using C# libraries to verify agent integrity. These diagnostics often load TypeLibGUIDs identical to those used by Red Team tools