Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies potential adversary activity by monitoring for known C# Red and Black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these specific identifiers allows the SOC team to distinguish between legitimate security testing operations and malicious tool usage that may mimic standard administrative behavior, thereby reducing false positives while enhancing visibility into internal threat landscape activities.

YARA Rule

rule HKTL_NET_GUID_SharpHound3 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/BloodHoundAD/SharpHound3"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "a517a8de-5834-411d-abda-2d0e1766539c" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/BloodHoundAD/SharpHound3
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scheduled Backup Verification Jobs

  • Scenario: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize C# .NET agents that load specific TypeLib GUIDs during their nightly verification or integrity check routines. These agents may mimic the behavior of Red/Black team tools by enumerating COM interfaces on the file system.
  • Filter/Exclusion: Create an exclusion for the backup agent process names (e.g., Veeam.Backup.Service.exe, commvault_agent.exe) and restrict detection to non-scheduled execution windows or exclude specific known TypeLib GUIDs associated with the vendor’s SDK.

• Microsoft Office 365 Click-to-Run Updates

  • Scenario: The Microsoft Office update service (OfficeClickToRun.exe or msiexec) frequently instantiates C# components to manage add-ins and registry keys, generating TypeLib GUIDs that overlap with those used by security testing frameworks. This often occurs during the daily maintenance window.
  • Filter/Exclusion: Exclude processes originating from the C:\Program Files\Microsoft Office directory path or filter based on the specific TypeLibGUID range assigned to Microsoft Office components (e.g., excluding GUIDs starting with 0002...).

• Enterprise Endpoint Management Agents (SCCM/Intune)

  • Scenario: System Center Configuration Manager (SCCM) or Intuna agents perform inventory scans and software deployment tasks using C# scripts. These tools often query the local COM registry, triggering the detection logic when they register new application components or verify existing ones.
  • Filter/Exclusion: Add an exclusion for known management agent processes such as `cc