Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversary activity where threat actors execute C#-based red or blue team tools that generate unique TypeLibGUID artifacts within the Azure environment. Proactively hunting for these specific GUIDs allows the SOC to distinguish legitimate security tooling from potential malicious reconnaissance or lateral movement attempts, ensuring low-severity signals are not overlooked during routine operations.

YARA Rule

rule HKTL_NET_GUID_SharpCradle {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/anthemtotheego/SharpCradle"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "f70d2b71-4aae-4b24-9dae-55bc819c78bb" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/anthemtotheego/SharpCradle
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects C# Red/Black-team tools via TypelibGUID rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM or Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents frequently execute C# deployment scripts to install patches or update applications. These tools often instantiate standard .NET libraries that share the same TypelibGUID as known red/black team reconnaissance tools during their initialization phase.
  • Suggested Filter/Exclusion: Create an exclusion for processes originating from the specific software distribution service paths (e.g., C:\Windows\CCM\*, C:\Program Files\Microsoft Intune Management Extension\*) or filter by the parent process name ccmexec.exe and IntuneManagementExtension.exe.

• Scenario: Scheduled Backup Operations using Veeam or Commvault

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize C#-based agents to perform integrity checks, catalog scans, or snapshot creation. These scheduled jobs (often running via Task Scheduler) load .NET assemblies that match the TypelibGUID signatures associated with security testing frameworks.
  • Suggested Filter/Exclusion: Exclude events where the parent process is a known backup service executable (e.g., VeeamAgent.exe, simserver.exe) and the execution time aligns with defined maintenance windows (e.g., 02:00–04:00 daily).

• Scenario: Endpoint Protection Scanning (CrowdStrike, SentinelOne)

  • Context: Modern EDR agents perform deep system scans that involve loading various C# modules to analyze memory and file systems. During these scans, the agent’s internal engine