Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis posits that adversaries are deploying custom C# red and black team tools within the environment, identifiable by unique typelibguid signatures associated with the NET_GUID malware family. Proactively hunting for these specific artifacts in Azure Sentinel is critical to distinguish legitimate security operations from potential malicious tooling that may be establishing persistence or reconnaissance capabilities under a low-severity profile.

YARA Rule

rule HKTL_NET_GUID_SharpShot {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/tothi/SharpShot"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "057aef75-861b-4e4b-a372-cfbd8322c8e1" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/tothi/SharpShot
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the HKTL_NET_GUID_SharpShot detection rule, tailored for an enterprise environment using C# red/black-team tools:

• Automated Patch Management Deployment

  • Scenario: The organization’s patch management system (e.g., Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti) executes a scheduled job to deploy .NET framework updates. During this process, the installer invokes C#-based deployment agents that register new TypeLib GUIDs in the registry (HKEY_CLASSES_ROOT\TypeLib) to manage versioning and COM interop for the update service.
  • Filter/Exclusion: Whitelist the specific executable paths of the patch management agent (e.g., C:\Program Files\Microsoft Configuration Manager\bin\x64\ccmexec.exe or IvantiAgent.exe) and exclude registry modifications originating from these processes during standard maintenance windows.

• Enterprise Application Performance Monitoring (APM)

  • Scenario: A third-party APM solution like Dynatrace, AppDynamics, or New Relic runs a background C# service to instrument .NET applications. This agent periodically updates its internal TypeLib GUIDs to track new application versions or modify instrumentation hooks, mimicking the behavior of red-team reconnaissance tools scanning for environment changes.
  • Filter/Exclusion: Create an exclusion rule based on the parent process name (e.g., OneAgentService.exe, AppDynamics-APM-Agent.exe) and restrict alerts to only trigger if the GUID creation occurs outside of known application deployment cycles or if the GUID does not match the vendor’s known signature hash.

• Identity Management & SSO Token Refresh

  • Scenario: The enterprise Identity Provider (e.g., Okta, Azure AD Connect, or **PingIdentity