Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by analyzing unique TypeLibGUID signatures associated with known C# red and black team reconnaissance or attack tools within the Azure Sentinel environment. Proactively hunting for these specific tool identifiers enables the SOC to distinguish between legitimate security operations and stealthy threat actor movements that leverage similar C#-based utilities, ensuring early visibility into potential lateral movement or data staging efforts.

YARA Rule

rule HKTL_NET_GUID_SharpEDRChecker {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/PwnDexter/SharpEDRChecker"
        author = "Arnim Rupp"
        date = "2020-12-18"
    strings:
        $typelibguid0 = "bdfee233-3fed-42e5-aa64-492eb2ac7047" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/PwnDexter/SharpEDRChecker
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID,” including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Jenkins, Azure DevOps) running .NET-based compilation or testing tasks often invoke C# tools like dotnet CLI or custom build scripts that load specific TypeLibGUIDs associated with Red Team simulation frameworks. These are legitimate automated processes rather than manual adversary activity.
  • Filter/Exclusion: Exclude the rule trigger if the process path matches known CI/CD agent directories (e.g., C:\Program Files\Microsoft Visual Studio\... or D:\BuildAgents\) AND the parent process is a recognized service like Jenkins.exe, VSTestRunner.exe, or AzureDevOpsAgent.exe.

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise EDR solutions (such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) frequently utilize C# modules to perform heuristic scans. These modules often register TypeLibGUIDs that overlap with common Red Team tool signatures during their scheduled daily or hourly scan windows.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 02:00–04:00 local time) for processes running under the context of MsMpEng.exe (Defender), FalconSensorService.exe, or S1Agent.exe. Alternatively, exclude if the process command line contains keywords like “scheduled scan” or “heuristic analysis.”

• Scenario: Legacy Office Add-in Initialization

  • Context: In environments with heavy Microsoft 365 usage, legacy Office add-ins (e.g., for SharePoint integration or specialized reporting) written in