Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate security testing operations and suspicious tool usage that may signal an attacker leveraging similar frameworks to establish persistence or conduct reconnaissance.

YARA Rule

rule HKTL_NET_GUID_SharpAttack {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jaredhaight/SharpAttack"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "5f0ceca3-5997-406c-adf5-6c7fbb6cba17" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/jaredhaight/SharpAttack
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Jenkins, Azure DevOps) frequently invoke C# compilation or testing frameworks like dotnet CLI or MSBuild.exe. These tools often instantiate .NET assemblies that generate specific TypeLibGUIDs associated with the build environment rather than an active Red Team attack.
  • Filter/Exclusion: Exclude processes running under service accounts (e.g., NT SERVICE\Jenkins, SYSTEM) where the parent process is a known CI/CD orchestrator (jenkins.exe, azagentworker.exe) and the file path resides within the build agent directory (e.g., C:\Program Files\Microsoft\Visual Studio\...).

• Scenario: Scheduled Office 365 ProPlus Updates

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) or scheduled update tasks utilize C# components to manage add-ins and registry keys. These operations trigger TypeLibGUIDs that mimic those used by reconnaissance tools like SharpHound or Bloodhound.
  • Filter/Exclusion: Create a filter excluding events where the process name is OfficeClickToRun.exe, msiexec.exe (with command line containing /quiet /passive), and the TypeLibGUID belongs to known Microsoft Office GUIDs (e.g., {000209FF-0000-0000-C000-000000000046}).

• Scenario: Enterprise Endpoint Protection Scans

  • Context: Antivirus or EDR solutions (e.g., CrowdStrike Falcon