Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging custom C# Red and Black team tools that register unique TypeLibGUIDs to establish persistence or execute reconnaissance activities within the environment. Proactively hunting for these specific GUID signatures in Azure Sentinel allows the SOC team to identify legitimate security tooling versus potential adversary implants, thereby reducing false positives while uncovering stealthy tool usage that may evade standard signature-based detections.

YARA Rule

rule HKTL_NET_GUID_SharpShooter {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/mdsecactivebreach/SharpShooter"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "56598f1c-6d88-4994-a392-af337abe5777" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/mdsecactivebreach/SharpShooter
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build servers (e.g., Jenkins, Azure DevOps) frequently compile C# applications or run unit tests using dotnet CLI or MSBuild. These processes often instantiate standard .NET assemblies that share the same typelibguid as known security tools like Cobalt Strike or BloodHound.
  • Filter/Exclusion: Exclude process paths containing build agent identifiers (e.g., *\.msbuild.exe, *\dotnet.exe) running under service accounts named BuildService, AzureDevOpsAgent, or Jenkins.

• Scenario: Scheduled Microsoft Endpoint Configuration Manager (MECM) Updates

  • Context: During scheduled maintenance windows, MECM agents execute C# scripts to deploy updates or inventory hardware. These scripts often load the .NET Framework runtime with a GUID identical to that used by Red Canary or Lacework agents during their initialization phase.
  • Filter/Exclusion: Create an exclusion for processes running under the SMS_* service accounts (e.g., NT SERVICE\SMS_EXECUTIVE) where the parent process is ccmexec.exe.

• Scenario: Active Directory PowerShell Scripting by Sysadmins

  • Context: System administrators run custom C#-based PowerShell scripts to manage user provisioning or group policy updates. If these scripts utilize libraries like PowerShellGet or Pester, they may trigger the detection logic due to overlapping typelibguid signatures with tools like GRC (Governance, Risk, and Compliance) scanners.
  • Filter/Exclusion: Filter out events where the parent process is