Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies the execution of specialized C# Red and Black team tools by analyzing unique TypeLibGUID artifacts to distinguish legitimate security testing from potential adversary activity. Proactively hunting for these signatures in Azure Sentinel allows the SOC team to validate authorized tool usage while rapidly detecting unauthorized or anomalous deployment of similar frameworks that could indicate stealthy reconnaissance or lateral movement attempts.

YARA Rule

rule HKTL_NET_GUID_SharpSniper {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/HunnicCyber/SharpSniper"
        author = "Arnim Rupp"
        date = "2020-12-29"
    strings:
        $typelibguid0 = "c8bb840c-04ce-4b60-a734-faf15abf7b18" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/HunnicCyber/SharpSniper
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects c# red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Update Service

  • Context: The OfficeClickToRun.exe process frequently registers C# type libraries during background updates or user profile initialization. These legitimate operations often match the specific GUIDs associated with Red Team tools (e.g., Mimikatz, BloodHound) that utilize similar .NET assemblies.
  • Suggested Filter: Exclude alerts where the ParentProcessName is OfficeClickToRun.exe and the CommandLine contains “Update” or “Install”.

• Scenario: Scheduled PowerShell Health Checks

  • Context: Enterprise IT teams often run scheduled tasks (via Task Scheduler) that execute custom C# scripts to monitor system health, inventory software, or validate Active Directory configurations. These scripts load specific .NET assemblies with GUIDs overlapping with Black Team forensic tools like SharpView or PowerSploit.
  • Suggested Filter: Create an exclusion rule for events originating from the “System” account (UserAccountName = SYSTEM) where the ProcessPath resides in a known administrative directory (e.g., C:\ProgramData\InternalScripts\).

• Scenario: Endpoint Detection and Response (EDR) Agent Scans

  • Context: Major EDR solutions (such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) utilize C# components to perform real-time file scanning and memory analysis. Their internal agents often load type libraries that trigger this rule when they interact with the .NET runtime during a scheduled scan cycle.
  • Suggested Filter: Exclude alerts where the ProcessName matches known EDR agent executables (e.g., FalconSensor.exe,