Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies the execution of C#-based red and black team tools by analyzing unique TypeLibGUID signatures to distinguish legitimate security activities from potential adversary tooling. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to establish a baseline of known good security tools, thereby reducing false positives and enabling rapid detection of novel or malicious C# applications that mimic trusted behavior.

YARA Rule

rule HKTL_NET_GUID_SharpExcel4_DCOM {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rvrsh3ll/SharpExcel4-DCOM"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "68b83ce5-bbd9-4ee3-b1cc-5e9223fab52b" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/rvrsh3ll/SharpExcel4-DCOM
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” along with suggested filters or exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Jenkins, Azure DevOps) running C# compilation tasks or unit tests using msbuild or dotnet CLI often instantiate .NET assemblies that trigger the specific TypeLibGUIDs associated with security tools.
  • Filter/Exclusion: Exclude processes originating from known CI/CD service accounts (e.g., NT SERVICE\Jenkins, CONTAINER_USER) running on dedicated build server FQDNs, or filter out process paths containing \build\ or \artifacts\.

• Scenario: Microsoft Defender for Endpoint (MDE) Telemetry

  • Context: The MDE sensor itself utilizes C# components to perform internal health checks and policy synchronization. These background processes frequently load TypeLibGUIDs that overlap with Red/Black team tool signatures, causing self-detection alerts.
  • Filter/Exclusion: Create an exclusion for the process name MsMpEng.exe (Microsoft Defender Antivirus) or SenseService.exe when the parent process is svchost.exe running under the LocalSystem account.

• Scenario: Scheduled Office 365 Configuration Tasks

  • Context: Enterprise scheduled jobs that configure Outlook add-ins or OneDrive sync policies often execute C# scripts (e.g., via PowerShell invoking .NET assemblies). These tasks generate TypeLibGUIDs similar to those used by penetration testing tools like Burp Suite or OWASP ZAP.
  • Filter/Exclusion: Exclude alerts where the parent process is OneDrive.exe or Outlook.exe and the execution occurs during defined maintenance windows (e