Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity involving C# red and black team tools by monitoring unique TypeLibGUID artifacts that often indicate reconnaissance or post-exploitation tool execution. Proactively hunting for these signatures in Azure Sentinel is essential to distinguish legitimate security operations from potential malicious tool deployment, ensuring early visibility into attacker infrastructure within the environment.

YARA Rule

rule HKTL_NET_GUID_SharpCompile {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/SpiderLabs/SharpCompile"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "63f81b73-ff18-4a36-b095-fdcb4776da4c" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/SpiderLabs/SharpCompile
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM or Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents frequently execute C# deployment scripts to install updates or applications. These processes often load the Microsoft.VisualStudio.Tools.Applications.Runtime or similar assembly, generating a specific typelibguid that matches Red/Black team tool signatures.
  • Suggested Filter: Exclude execution paths containing \Microsoft\CCMExec\ (SCCM) or \Microsoft Intune Management Extension\. Additionally, filter for parent processes named ccmexec.exe, IntuneManagementExtension.exe, or TaskHostW32.exe when the command line contains deployment keywords like /install, /update, or deployment.

• Scenario: Scheduled Office 365 ProPlus Click-to-Run Updates

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) runs scheduled maintenance tasks to check for updates and repair installations. During these background operations, it instantiates C# libraries used by the Office suite (e.g., Microsoft.Office.Interop.Excel), which share GUIDs with common Red Team reconnaissance tools like BloodHound or SharpView.
  • Suggested Filter: Create an exclusion for the process name OfficeClickToRun.exe combined with a specific command-line argument check for /update or /repair. If the rule relies on file hashes, whitelist the known good SHA256 hash of the Office Click-to-Run executable.

• Scenario: Visual Studio Build and Release Pipelines (Azure DevOps)

  • Context: In enterprise development environments, Azure DevOps agents or local build servers