Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity by monitoring for specific TypeLibGUIDs associated with known C# Red and Black team tools used during penetration testing or attack simulations. Proactively hunting for these indicators in Azure Sentinel enables the SOC to distinguish between legitimate security exercises and potential malicious reconnaissance, ensuring that tool usage aligns with authorized operations before escalating anomalies.

YARA Rule

rule HKTL_NET_GUID_SharpLocker {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Pickfordmatt/SharpLocker"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "a6f8500f-68bc-4efc-962a-6c6e68d893af" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

Scenario: Automated Backup Scripts using PowerShell
- Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize C# assemblies within PowerShell scripts to manage file integrity or database snapshots. These tools may instantiate specific COM objects that match the typelibguid signatures of red-team tools like Cobalt Strike Beacon or Mimikatz.
- Suggested Filter/Exclusion: Create an exclusion for processes running under the context of known backup service accounts (e.g., VeeamBackupService, CommvaultAgent) and restrict detection to specific file paths where these services reside, ignoring matches in generic temp directories (C:\Temp, C:\Windows\Temp).
Scenario: Microsoft Endpoint Manager (Intune) Compliance Checks
- Context: The Intune Management Extension or Configuration Manager (SCCM) agents frequently execute C# based compliance checks and inventory collection tasks. These agents often load standard .NET libraries that share the same typelibguid patterns as black-team forensic tools like Sysmon or LogParser.
- Suggested Filter/Exclusion: Exclude processes with parent images matching Microsoft.IntuneManagementExtension.exe, ccmexec.exe, or TpmService.exe. Additionally, filter out events where the command line contains keywords related to “inventory,” “compliance,” or “heartbeat.”
Scenario: Scheduled Office 365 ProPlus Updates
- Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) performs scheduled updates and feature installations using C# components. These operations can trigger the specific typelibguid associated with tools like BloodHound or SharpUp during the installation