Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity involving C#-based red and black team tools that leverage specific typelib GUID signatures to execute .NET payloads within the environment. Proactive hunting for these indicators in Azure Sentinel is essential to distinguish legitimate security testing from potential malicious reconnaissance or lateral movement attempts by threat actors utilizing similar tooling techniques.

YARA Rule

rule HKTL_NET_GUID_SharpExec {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/anthemtotheego/SharpExec"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "7fbad126-e21c-4c4e-a9f0-613fcf585a71" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/anthemtotheego/SharpExec
• Source Rule

False Positive Guidance

False Positive Scenarios for HKTL_NET_GUID_SharpExec Rule

• Scenario: Legitimate .NET Development Build Processes

  • Context: Developers running continuous integration (CI) pipelines or local builds using Microsoft Visual Studio or MSBuild. These tools frequently instantiate C# assemblies that register specific TypeLibGUIDs matching the rule’s signature during compilation and testing phases.
  • Suggested Filter/Exclusion: Create an exclusion based on the parent process name devenv.exe (Visual Studio) or msbuild.exe, specifically targeting file paths within standard development directories (e.g., C:\Program Files\Microsoft Visual Studio\... or D:\Builds\).

• Scenario: Scheduled PowerShell Automation Scripts

  • Context: Enterprise IT operations utilizing scheduled tasks that execute C#-based PowerShell modules for routine maintenance, such as Active Directory user provisioning or Exchange mailbox management. These scripts often load .NET assemblies with matching GUIDs to interact with system APIs.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is powershell.exe and the command line contains specific keywords like -Command, -File, or references to known internal automation script repositories (e.g., paths starting with C:\Scripts\IT_Ops\).

• Scenario: Endpoint Security Agent Updates

  • Context: Third-party endpoint protection agents (such as CrowdStrike, Carbon Black, or SentinelOne) performing background updates or policy synchronization. These agents often use C# components to communicate with the management console, triggering TypeLibGUID registrations that mimic the detection logic.
  • Suggested Filter/Exclusion: Add a whitelist for known security vendor processes (e.g., csagent.exe, cb.exe, SentinelOneAgent.exe) and their associated update service paths, ensuring these legitimate background activities do not trigger