Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects the execution of C#-based red and black team tools by identifying unique TypeLibGUID signatures often associated with reconnaissance and post-exploitation activities. Proactively hunting for these indicators in Azure Sentinel allows the SOC to distinguish legitimate security tooling from adversarial use of similar frameworks, ensuring early visibility into potential threat actor presence within the environment.

YARA Rule

rule HKTL_NET_GUID_SharpCall {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jhalon/SharpCall"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "c1b0a923-0f17-4bc8-ba0f-c87aff43e799" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/jhalon/SharpCall
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Azure DevOps or Jenkins) running on Windows servers frequently execute C# compilation tasks using the .NET SDK. These processes often load standard Red Team libraries (like Microsoft.CSharp or specific testing frameworks) that match the rule’s TypelibGUID signatures during automated builds.
  • Filter/Exclusion: Create an exclusion for process names matching known build agents (e.g., msbuild.exe, dotnet.exe, vstest.console.exe) running under service accounts like SYSTEM or specific CI user identities (CI-Build-Service).

• Scenario: Scheduled Endpoint Security Updates

  • Context: Enterprise EDR solutions (such as CrowdStrike, Microsoft Defender for Endpoint, or SentinelOne) utilize C# components to manage policy updates and threat intelligence feeds. During scheduled morning maintenance windows, these agents load internal TypelibGUIDs that mimic Red Team tool signatures while scanning the system registry.
  • Filter/Exclusion: Exclude events where the parent process is a known security agent (e.g., C:\Program Files\CrowdStrike\fsqa.exe or C:\Windows\System32\sensrvc.dll) and the execution time falls within the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Internal IT Management Dashboard Refresh

  • Context: A centralized internal dashboard application written in C# is used by IT administrators to monitor asset inventory. This tool utilizes a shared library containing TypelibGUIDs identical to those found in standard Red Team reconnaissance tools (like SharpHunt or similar)