Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based Red and Black team tools that expose unique TypeLibGUID artifacts to identify specific reconnaissance or post-exploitation activities within the environment. Proactively hunting for these signatures in Azure Sentinel allows the SOC team to distinguish legitimate tooling from malicious execution, ensuring early visibility into potential lateral movement or command-and-control infrastructure before it escalates to a higher severity incident.

YARA Rule

rule HKTL_NET_GUID_SharpDump {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/SharpDump"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "79c9bba3-a0ea-431c-866c-77004802d8a0" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/GhostPack/SharpDump
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Automated Patch Management Execution

  • Context: The enterprise uses a centralized patching solution (e.g., Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti) to deploy updates. These tools often utilize C# libraries with specific typelibguid signatures to interact with the Windows Registry and file systems during scheduled maintenance windows.
  • Suggested Filter: Exclude processes originating from known patch management service accounts (e.g., NT SERVICE\CCMExec, LocalSystem) running on the primary application server path: C:\Program Files (x86)\Microsoft Configuration Manager\.

• Scenario: Internal DevOps Build Pipeline Agents

  • Context: A CI/CD pipeline (running on Azure DevOps Agents or Jenkins) executes build scripts that compile C# applications. These agents frequently invoke compilation tools (like MSBuild or custom internal wrappers) which generate the specific GUIDs associated with Red/Blue team tooling during the “build” and “test” phases of software releases.
  • Suggested Filter: Create an exclusion for process names containing dotnet, msbuild.exe, or vstest.console.exe when executed within the directory structure of the build agent (e.g., C:\Program Files\Microsoft Visual Studio\2022\Agent or /var/lib/jenkins/workspace).

• Scenario: Enterprise Endpoint Detection and Response (EDR) Scans

  • Context: The organization’s EDR solution (such as CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint) performs deep behavioral analysis. During these scans, the EDR engine