Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLibGUIDs to establish persistence or execute reconnaissance within Azure environments. Proactively hunting for these specific GUID signatures in Azure Sentinel allows the SOC team to distinguish legitimate automation from stealthy adversary tooling, even when initial alerts are flagged with low severity.

YARA Rule

rule HKTL_NET_GUID_SharpDPAPI {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/SharpDPAPI"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "5f026c27-f8e6-4052-b231-8451c6a73838" ascii nocase wide
        $typelibguid1 = "2f00a05b-263d-4fcc-846b-da82bd684603" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/GhostPack/SharpDPAPI
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Scenario: Automated Patch Management Deployment (SCCM/MECM)

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) frequently loads C# assemblies to manage software updates. During the deployment of .NET Framework patches or application packages, it generates a typelibguid associated with internal Microsoft management libraries that mimic Red/Blue team tool signatures.
  • Suggested Filter: Exclude processes where the parent process is ccmexec.exe and the file path contains \Microsoft\CCM\. Additionally, filter out specific GUIDs known to belong to the SCCM agent (e.g., {A1B2C3D4-E5F6-7890...}).

• Scenario: Scheduled Antivirus Real-Time Scanning

  • Context: Enterprise Endpoint Protection solutions (such as CrowdStrike Falcon, Carbon Black, or Symantec) utilize C# components for their real-time scanning engines. When these agents perform scheduled deep scans or definition updates at 2:00 AM, they instantiate C# libraries that register with a typelibguid often flagged by the rule as an external “Red Team” reconnaissance tool.
  • Suggested Filter: Create an exclusion for known security vendor process names (e.g., C:\Program Files\CrowdStrike\csagent.exe, Symantec Endpoint Protection\SmcGui.exe). Whitelist the specific typelibguid values associated with these vendors’ core scanning modules.

• Scenario: Microsoft Office 365 Click-to-Run Updates

  • Context: The Office Click-to-Run service (OfficeClickToRun.exe) manages background