Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based Red and Black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these specific tool identifiers is essential to distinguish legitimate security operations from malicious reconnaissance or lateral movement attempts that mimic standard administrative behavior.

YARA Rule

rule HKTL_NET_GUID_SharpCOM {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rvrsh3ll/SharpCOM"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "51960f7d-76fe-499f-afbd-acabd7ba50d1" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/rvrsh3ll/SharpCOM
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects c# red/black-team tools via typelibguid rule, including suggested filters and exclusions:

• Scenario: Microsoft Office Add-in Deployment

  • Context: When IT administrators deploy or update Office add-ins (e.g., Power BI Desktop, Teams Meeting Add-in) on endpoints, the installation process often registers COM type libraries that match known Red/Black team tool GUIDs. This triggers the rule during routine patching windows.
  • Filter/Exclusion: Exclude processes running under msiexec.exe or setup.exe where the parent process is a trusted deployment service (e.g., SCCM, Intune). Specifically, filter out events where the command line contains /quiet or /passive flags indicating an automated installation.

• Scenario: Automated Backup and Archiving Jobs

  • Context: Enterprise backup solutions like Veeam Agent for Microsoft Windows or Acronis Cyber Protect utilize C# components to manage file indexing and metadata. These tools often instantiate type libraries that collide with the detection logic during scheduled nightly backups, generating alerts when no security team activity is occurring.
  • Filter/Exclusion: Create a process exclusion list for known backup executables (e.g., VeeamAgent.exe, AcronisBackupService.exe). Additionally, add a time-based filter to suppress alerts generated between 01:00 and 05:00 local time on weekdays when these jobs typically run.

• Scenario: Endpoint Detection and Response (EDR) Scanning

  • Context: Native EDR agents such as Microsoft Defender for Endpoint or CrowdStrike Falcon frequently perform deep scans of the registry and file system. During these scans, they query COM objects and type libraries to verify integrity, inadvertently triggering the rule because their internal C# modules share similar GUID