Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLib GUIDs to establish persistence or execute reconnaissance within the Azure environment. Proactively hunting for these specific identifiers allows the SOC team to distinguish legitimate tooling from stealthy adversary activity, ensuring early identification of potential lateral movement or command-and-control infrastructure before it escalates in severity.

YARA Rule

rule HKTL_NET_GUID_Povlsomware {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/povlteksttv/Povlsomware"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "fe0d5aa7-538f-42f6-9ece-b141560f7781" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/povlteksttv/Povlsomware
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters and exclusions:

• Scheduled Software Distribution via SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) or the Application Deployment Service frequently loads C# assemblies containing known Red Team tool typelib GUIDs during routine software updates, patch deployments, or inventory scans. These actions occur on a strict schedule across thousands of endpoints.
  • Filter/Exclusion: Create an exclusion for the process path C:\Windows\CCM\* and specifically whitelist the parent process ccmexec.exe. Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 local time) where mass deployment is expected.

• Endpoint Detection & Response (EDR) Agent Scans

  • Scenario: Major EDR solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne utilize C# libraries to analyze file integrity and memory states. When these agents perform deep scans of the C:\Windows\Microsoft.NET\Framework directory or specific application folders, they may instantiate typelib GUIDs associated with common red team frameworks (e.g., SharpUp, Invoke-Command) as part of their signature matching engine.
  • Filter/Exclusion: Exclude events where the parent process matches known EDR service executables (e.g., C:\Program Files\CrowdStrike\fs.exe, MsMpEng.exe). If the tool generates a specific “Scan” or “Integrity Check” event ID, add that to the exclusion logic.

• Automated PowerShell Health Checks by IT Operations

  • Scenario: The IT operations team runs daily scheduled PowerShell scripts (e.g., via