Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies the execution of specialized C# Red and Black team security tools by analyzing unique TypelibGUID signatures within Azure Sentinel logs. Proactively hunting for these indicators allows the SOC team to distinguish legitimate security testing activities from potential adversary reconnaissance or tool deployment that mimics known security utilities.

YARA Rule

rule HKTL_NET_GUID_SharpPrinter {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rvrsh3ll/SharpPrinter"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "41b2d1e5-4c5d-444c-aa47-629955401ed9" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/rvrsh3ll/SharpPrinter
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” along with suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: Enterprise Configuration Management (SCCM) or Microsoft Intune agents frequently utilize C#-based PowerShell scripts to deploy patches. These scripts often instantiate COM objects or .NET assemblies that generate specific typelibguid values matching known Red Team tools (e.g., mimicking the GUIDs of tools like SharpUp or PowerSploit).
  • Filter/Exclusion: Create an exclusion based on the parent process name. Filter out alerts where the parent process is ccmexec.exe, msedge.exe (for Intune), or wuauserv.exe. Additionally, exclude specific known GUIDs associated with Microsoft Update components if they overlap with tool signatures.

• Scenario: Scheduled Backup and Compliance Scans

  • Context: Internal compliance teams run nightly scheduled jobs using C# tools like Veeam Explorer or custom audit scripts (e.g., utilizing the Cobalt Strike Beacon framework for internal monitoring) that load specific TypeLibs. These jobs often trigger during off-hours, generating alerts that look like active Red Team reconnaissance but are actually routine maintenance.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00–05:00 local time) for known backup service accounts (e.g., DOMAIN\svc_backup). Alternatively, exclude alerts where the user context is a dedicated service account rather than an interactive user session.

• Scenario: Development Environment Build Pipelines

  • Context: In hybrid environments where developers have access to production-like resources, CI/CD pipelines (e.g., Azure DevOps or