Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt identifies adversary activity involving C# red and black team tools by analyzing unique TypeLibGUID artifacts often generated during reconnaissance or post-exploitation phases. Proactively hunting for these indicators in Azure Sentinel is critical to distinguish legitimate security operations from malicious tool execution that may otherwise evade standard signature-based detections due to their low-severity classification.

YARA Rule

rule HKTL_NET_GUID_SharpPack {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Lexus89/SharpPack"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid1 = "b59c7741-d522-4a41-bf4d-9badddebb84a" ascii nocase wide
        $typelibguid2 = "fd6bdf7a-fef4-4b28-9027-5bf750f08048" ascii nocase wide
        $typelibguid3 = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii nocase wide
        $typelibguid5 = "f3037587-1a3b-41f1-aa71-b026efdb2a82" ascii nocase wide
        $typelibguid6 = "41a90a6a-f9ed-4a2f-8448-d544ec1fd753" ascii nocase wide
        $typelibguid7 = "3787435b-8352-4bd8-a1c6-e5a1b73921f4" ascii nocase wide
        $typelibguid8 = "fdd654f5-5c54-4d93-bf8e-faf11b00e3e9" ascii nocase wide
        $typelibguid9 = "aec32155-d589-4150-8fe7-2900df4554c8" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• https://github.com/Lexus89/SharpPack
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters or exclusions:

• Scenario: Automated Software Deployment via SCCM/MECM

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) frequently executes C#-based deployment agents and custom scripts to install patches or software. These processes often instantiate COM objects with specific typelibguids that overlap with red-team tool signatures (e.g., mimicking PowerShell or .NET framework interactions).
  • Suggested Filter: Create an exclusion for the parent process path C:\Windows\CCM\* and specifically whitelist the known SCCM typelibguid values associated with standard deployment packages.

• Scenario: Microsoft Defender Antivirus Real-Time Scanning

  • Context: The Microsoft Defender Antivirus engine (MsMpEng.exe) utilizes C# components for heuristic analysis and script scanning. During routine scheduled scans or on-demand file checks, it may load DLLs containing typelibguids that match the detection logic for tools like “Cobalt Strike” or “Empire,” triggering alerts during normal background operations.
  • Suggested Filter: Exclude events where the process name is MsMpEng.exe and the user context is NT AUTHORITY\SYSTEM, as these represent standard, trusted security engine activities rather than adversarial tool execution.

• Scenario: Scheduled PowerShell Maintenance Jobs

  • Context: Enterprise environments often run scheduled tasks (Task Scheduler) that execute complex C#-backed PowerShell scripts for log rotation, database backups, or configuration drift detection. Tools like PowerShell.exe launching these jobs may generate typelibguids associated with common Red Team frameworks (e.g., mimicking the GUIDs used by “Invoke-