Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for specific TypeLibGUIDs associated with known C# offensive and defensive tools used in red and black team engagements. Proactively hunting for these signatures within Azure Sentinel allows the SOC to distinguish between legitimate security operations and malicious tool usage, ensuring early visibility into reconnaissance or post-exploitation phases that might otherwise blend into routine administrative noise.

YARA Rule

rule HKTL_NET_GUID_Sharp_WMIExec {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/checkymander/Sharp-WMIExec"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "0a63b0a1-7d1a-4b84-81c3-bbbfe9913029" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/checkymander/Sharp-WMIExec
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Microsoft Visual Studio Build & Publish Operations

  • Context: During nightly CI/CD pipelines or developer workstations, msbuild.exe or devenv.exe (Visual Studio) frequently loads .NET assemblies that generate specific TypeLibGUIDs associated with Red Team tooling libraries (e.g., SharpUp or custom internal agents). This often triggers the rule when developers are compiling C# projects.
  • Filter/Exclusion: Exclude processes where Parent_Process_Name is msbuild.exe, devenv.exe, or dotnet.exe. Additionally, filter out events originating from build server accounts (e.g., DOMAIN\CI-Build-Svc) to distinguish between developer activity and active threat hunting.

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise EDR agents (such as CrowdStrike Falcon or Microsoft Defender for Endpoint) utilize C# based modules for real-time monitoring. When the scheduled “On-Demand Scan” runs, these agents instantiate internal .NET components that match the TypeLibGUIDs of tools like SharpChmod or BloodHound, causing false alerts during maintenance windows.
  • Filter/Exclusion: Create a time-based exclusion for known maintenance windows (e.g., 02:00–04:00 UTC). Furthermore, exclude process paths containing \Program Files\Microsoft Defender AntiVirus\ or \CrowdStrike\FalconAgent\ to filter out the EDR’s own internal .NET activity.

• Scenario: Active Directory Schema Updates via PowerShell

  • Context: System administrators often run custom C# scripts (e.g., using System.DirectoryServices.Protocols)