Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity involving C#-based red and black team tools by analyzing unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC to distinguish between legitimate security testing operations and potential malicious reconnaissance or tool deployment by threat actors leveraging similar .NET frameworks.

YARA Rule

rule HKTL_NET_GUID_SharpLogger {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/djhohnstein/SharpLogger"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "36e00152-e073-4da8-aa0c-375b6dd680c4" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/djhohnstein/SharpLogger
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the HKTL_NET_GUID_SharpLogger rule, along with targeted mitigation strategies:

• Scenario: Execution of Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Context: The SCCM client (ccmsetup.exe) frequently invokes C#-based logging components during inventory scans and software deployment tasks. These processes often generate typelibguid entries that match the Red/Black team tool signatures due to shared .NET runtime libraries.
  • Filter/Exclusion: Exclude process paths containing \Microsoft\CCM\ or specifically target ccmsetup.exe and ccmexec.exe when running under the SYSTEM account on management servers.

• Scenario: Scheduled PowerShell Script for Compliance Reporting

  • Context: A daily scheduled job (Task Scheduler) runs a custom C# wrapper script (e.g., ComplianceLogger.dll) to aggregate audit logs and generate PDF reports for compliance teams. This tool utilizes the same underlying .NET serialization logic detected by the YARA rule.
  • Filter/Exclusion: Create an exclusion based on the specific scheduled task name (e.g., “Daily Compliance Report”) or filter by the parent process powershell.exe running from a known enterprise directory path like C:\Scripts\Compliance\.

• Scenario: Deployment of Microsoft Defender for Endpoint Custom Sensors

  • Context: The deployment of custom sensors via the Defender console often triggers C# background services that initialize logging mechanisms. These services register specific TypeLib GUIDs that overlap with the detection logic for red-team tools like SharpLogger.
  • Filter/Exclusion: Exclude processes where the image path contains \Program Files\Microsoft Defender Antimalware\ and the process name matches MsMpEng.exe or SenseService.exe.

• **Scenario