Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity by monitoring for specific TypeLibGUID signatures associated with known C# red and black team reconnaissance or exploitation tools within Azure Sentinel. Proactive hunting for these indicators is essential to uncover early-stage threat actor presence that may evade standard signature-based alerts, allowing the SOC team to validate tool usage before lateral movement occurs.

YARA Rule

rule HKTL_NET_GUID_SharpBox {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/P1CKLES/SharpBox"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "616c1afb-2944-42ed-9951-bf435cadb600" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/P1CKLES/SharpBox
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” along with suggested filters or exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Azure DevOps, Jenkins) running C#-based unit tests or integration scripts that instantiate .NET assemblies containing specific typelibguid values used by security tools.
  • Filter/Exclusion: Exclude processes running under the build service account (e.g., NT SERVICE\TeamFoundationBuildAgent) and restrict detection to non-build server workstations.

• Scenario: Microsoft Defender for Endpoint (MDE) Telemetry

  • Context: The MDE sensor or its associated C# management agent (SenseBrokerService.exe or MsSenseBroker.exe) periodically queries internal libraries that share the same typelibguid signatures as common red-team tools like SharpUp or Bloodhound.
  • Filter/Exclusion: Create an exclusion for process names matching *SenseBroker*.exe, *MsSenseBroker*.exe, and *DefenderService.exe.

• Scenario: Scheduled Office 365 ProPlus Updates

  • Context: The scheduled update task (OfficeClickToRun.exe) or the Microsoft Identity Manager (MIM) service runs C# components that load COM libraries with identical GUIDs to tools like SharpHound or PowerShell Empire.
  • Filter/Exclusion: Add a filter excluding events where the parent process is Microsoft Office Click-to-Run.exe and the execution path contains \Program Files\Microsoft Office Root\Office16\.

• Scenario: Internal IT Management Suite (e.g., SCCM/MECM)

  • Context: System Center Configuration Manager (SCCM)