Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based offensive or defensive tools that register unique TypeLibGUIDs to establish persistence and evade signature-based detection within Azure Sentinel environments. Proactively hunting for these specific GUID patterns allows the SOC team to identify early-stage tool deployment by red teams or threat actors before they execute broader reconnaissance or lateral movement activities.

YARA Rule

rule HKTL_NET_GUID_SharPersist {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/fireeye/SharPersist"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "9d1b853e-58f1-4ba5-aefc-5c221ca30e48" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/fireeye/SharPersist
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Automated .NET Deployment via PowerShell

  • Context: The DevOps team runs a scheduled nightly job using PowerShell to deploy updates. This script invokes the .NET runtime (wof.exe) or specific deployment agents (e.g., Octopus Deploy Tentacle) which register new TypeLibGUIDs during the installation phase, mimicking Red Team tool behavior.
  • Filter/Exclusion: Exclude processes where ProcessName is powershell.exe AND CommandLine contains keywords like “Octo.Exe”, “Tentacle”, or “MSBuild” running on known deployment servers (e.g., Server-Deploy-01).

• Scenario: Endpoint Protection Scanning

  • Context: The enterprise EDR solution (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) performs a routine scan of the .NET framework directory. During this scan, the EDR agent interacts with COM objects and registers TypeLibGUIDs associated with its own C# management modules, triggering the rule as if an external tool was launched.
  • Filter/Exclusion: Create an exclusion for ProcessName matching known EDR agents (e.g., Cns.exe, MsMpEng.exe) where the parent process is the OS scheduler (svchost.exe) or the EDR service itself, specifically when the activity occurs within the standard maintenance window (02:00–04:00).

• Scenario: Office 365 Add-in Initialization

  • Context: Users launching Microsoft Outlook or Excel with custom C# add-ins (such as a corporate email archiving tool like “Mailstore” or a document management connector) trigger