Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies the execution of known C# red and black team tools by monitoring unique TypeLibGUID artifacts often used during security assessments or post-exploitation activities. Proactively hunting for these indicators in Azure Sentinel is essential to distinguish legitimate testing traffic from potential adversary use of similar custom frameworks, ensuring that authorized tooling does not mask malicious reconnaissance or lateral movement.

YARA Rule

rule HKTL_NET_GUID_Gopher {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/EncodeGroup/Gopher"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "b5152683-2514-49ce-9aca-1bc43df1e234" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/EncodeGroup/Gopher
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, tailored for an enterprise environment:

• Scenario: Automated Patch Deployment via SCCM/Microsoft Endpoint Configuration Manager (MECM)

  • Context: During scheduled maintenance windows, MECM agents on domain controllers and file servers execute the Microsoft.Update.Agent or custom C# deployment scripts to install OS updates. These tools utilize specific COM interfaces that generate standard TypelibGUIDs associated with Microsoft’s internal tooling suite, which overlaps with known Red/Blue team signatures.
  • Suggested Filter: Exclude processes where the parent process is ccmexec.exe or WmiPrvSE.exe and the command line contains arguments related to “SoftwareUpdates” or “Deployment,” specifically targeting the TypelibGUID range associated with Microsoft Update agents (e.g., excluding GUIDs starting with {E5...}).

• Scenario: Enterprise Backup Verification Jobs using Veeam Backup & Replication

  • Context: The nightly backup verification job runs a C# utility (Veeam.Backup.Engine.exe) to validate the integrity of critical SQL and Exchange database backups. This utility loads specific .NET libraries for cryptographic hashing, triggering the detection logic due to shared TypelibGUIDs used by security analysis tools for similar cryptographic operations.
  • Suggested Filter: Create an exclusion rule for processes running under the Veeam service account (e.g., DOMAIN\VeeamService) where the file path contains \Program Files\Microsoft Veeam\Backup and Replication\Server\, and the specific TypelibGUID matches the known backup engine signature.

• Scenario: Identity Management Synchronization via Microsoft Entra Connect (formerly Azure AD Connect)

  • Context: The scheduled synchronization job (AdSyncEngine.exe) runs every