Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies the execution of specialized C# Red and Black team security tools by analyzing unique TypeLibGUID signatures within process creation events. Proactive hunting for these indicators in Azure Sentinel is essential to distinguish legitimate security operations from potential adversary activity that mimics trusted tooling behavior, thereby reducing false positives and uncovering stealthy lateral movement attempts.

YARA Rule

rule HKTL_NET_GUID_SharpGPOAbuse {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/FSecureLABS/SharpGPOAbuse"
        author = "Arnim Rupp"
        date = "2020-12-21"
    strings:
        $typelibguid0 = "4f495784-b443-4838-9fa6-9149293af785" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/FSecureLABS/SharpGPOAbuse
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Monitoring Agents

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik) or monitoring agents (e.g., SolarWinds, Datadog) often utilize C# libraries that register specific TypeLibGUIDs during their scheduled maintenance windows. These tools frequently instantiate COM objects to query system state, mimicking the behavior of red-team reconnaissance tools like SharpHound or Bloodhound.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name and Parent Process. Exclude alerts where the process name matches known enterprise agents (e.g., Veeam.Backup.Service.exe, SolarWinds.Agent.exe) running under a service account context (e.g., NT SERVICE\VeeamBackupService).

• Scenario: Office 365/SharePoint Proactive Updates

  • Context: Microsoft Office Click-to-Run or SharePoint Services often trigger C# assemblies to handle licensing checks, feature updates, or synchronization tasks. These background processes frequently load TypeLibGUIDs associated with the .NET Framework that overlap with those used by tools like SharpUp or PowerView.
  • Filter/Exclusion: Implement a filter based on Image Path. Exclude any events where the executable path resides within standard Microsoft installation directories, such as C:\Program Files\Microsoft Office\root\Office16\ or C:\Program Files\Microsoft SharePoint Server\, regardless of the specific TypeLibGUID detected.

• Scenario: Scheduled PowerShell Scripting for Compliance

  • Context: Internal IT operations often run scheduled PowerShell scripts (Task Scheduler) that invoke C# assemblies to generate compliance