Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects the execution of C#-based Red and Black team tools by identifying unique TypeLibGUID signatures that often indicate reconnaissance or post-exploitation activities within the environment. Proactive hunting for these specific tool identifiers in Azure Sentinel is essential to distinguish legitimate security operations from adversarial use of similar frameworks, ensuring early visibility into potential threat actor movements even when standard behavioral anomalies are absent.

YARA Rule

rule HKTL_NET_GUID_SharpSearch {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/djhohnstein/SharpSearch"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "98fee742-8410-4f20-8b2d-d7d789ab003d" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/djhohnstein/SharpSearch
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” including suggested filters and exclusions:

• Scenario: Automated Build Pipeline Execution on CI/CD Agents

  • Context: Jenkins, Azure DevOps, or GitHub Actions agents frequently compile C# projects using msbuild.exe or dotnet.exe. These processes instantiate .NET assemblies that generate specific TypeLibGUIDs often flagged as “Red Team” reconnaissance tools (e.g., mimicking SharpUp or BloodHound).
  • Filter/Exclusion: Exclude the process image path for known CI/CD agents.
    • Example: ProcessImage | contains "C:\Program Files\Microsoft Visual Studio\2022\MSBuild" and ProcessCommandLine | has "--restore"

• Scenario: Scheduled Anti-Virus or EDR Scanning Jobs

  • Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike, SentinelOne, or Microsoft Defender often use C# based scanning engines that load COM libraries during scheduled deep scans. The typelibguid associated with these scanner modules can overlap with tools used by Red Teams for file enumeration.
  • Filter/Exclusion: Create a rule exclusion based on the parent process of the EDR service or specific scheduled task names.
    • Example: Exclude events where ParentProcessName is “C:\Program Files\CrowdStrike\csagent.exe” OR ScheduledTaskName contains “Defender Scheduled Scan”.

• Scenario: Microsoft Office 365 Background Updates and Add-in Initialization

  • Context: When users launch Outlook or Word, the application loads various C# add-ins (e.g., Teams integration, Power Automate connectors). These add-ins register TypeLibGUIDs that can be mistaken for network