Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies potential adversary activity by detecting the execution of known C# red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel. Proactively hunting for these indicators allows the SOC team to distinguish between legitimate security testing operations and malicious tool usage that may mimic authorized engineering activities, thereby reducing false positives while uncovering stealthy reconnaissance efforts.

YARA Rule

rule HKTL_NET_GUID_SharpMapExec {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/cube0x0/SharpMapExec"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "bd5220f7-e1fb-41d2-91ec-e4c50c6e9b9f" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/cube0x0/SharpMapExec
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Azure DevOps or Jenkins) running on Windows hosts frequently execute dotnet CLI tools or custom C# build scripts during nightly compilation cycles. These tools often instantiate specific COM objects that match the rule’s TypelibGUIDs, triggering alerts for every successful build run.
  • Filter/Exclusion: Create a process-based exclusion for known CI service accounts (e.g., NT SERVICE\TeamFoundationBuildAgent) and restrict the detection scope to exclude processes running under these specific user contexts or from known build server IP ranges.

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Context: The SCCM client (ccmexec.exe or wuauserv.exe) regularly performs inventory scans and software deployment tasks using C# components that register specific TypelibGUIDs. This often occurs during the standard maintenance window, causing high-volume alerts that mimic Red Team tool usage.
  • Filter/Exclusion: Exclude processes with parent process names containing “ccmexec” or “wuauserv” from the rule logic, and add a time-based filter to suppress alerts during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Enterprise Antivirus Real-Time Scanning

  • Context: Major EDR solutions like Microsoft Defender for Endpoint or CrowdStrike utilize C# modules for real-time file system monitoring and threat intelligence updates. These background services often load the same COM libraries identified by the rule, generating alerts whenever a large batch of files is scanned.
  • Filter/Exclusion: