Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies the execution of C#-based Red and Black team tools by analyzing unique TypeLibGUID signatures often used during penetration testing or security assessments. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to distinguish legitimate security activities from potential adversary use of custom C# utilities, ensuring that known tooling is not overlooked while unknown variations are investigated.

YARA Rule

rule HKTL_NET_GUID_SharpClipboard {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/slyd0g/SharpClipboard"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "97484211-4726-4129-86aa-ae01d17690be" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/slyd0g/SharpClipboard
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: CI/CD agents (e.g., Azure DevOps or Jenkins) running on build servers frequently execute C# compilation tasks using the .NET SDK. These processes often load standard assembly type libraries that match the GUIDs used by Red Team tools like SharpChisel or PowerSploit.
  • Filter/Exclusion: Exclude process paths containing C:\Program Files\Microsoft Visual Studio or C:\Windows\Microsoft.NET\Framework64. Additionally, filter out events where the parent process is msbuild.exe, dotnet.exe, or specific CI service accounts (e.g., NT SERVICE\BuildAgent).

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise EDR agents (such as Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne) perform scheduled scans that involve loading C# components to analyze file signatures. The scanning engine may instantiate a COM object with a TypelibGUID identical to those used by Black Team tools like BloodHound collectors or Lateral Movement simulators.
  • Filter/Exclusion: Create an exclusion for the specific process names of the EDR agents (e.g., MsMpEng.exe, FalconSensorService.exe). Filter based on the user context, excluding events triggered by local system accounts (SYSTEM) or dedicated service accounts running during known maintenance windows.

• Scenario: Office 365 Click-to-Run Updates

  • Context: The Microsoft Office Click-to-Run update mechanism utilizes C# components to manage installation and configuration. During large-scale updates, the OfficeClickToRun.exe process loads