Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying C#-based red and black team tools that leverage specific typelibguid signatures to mimic legitimate .NET activity within the NET_GUID malware family. Proactively hunting for these indicators in Azure Sentinel is essential to distinguish between benign security operations and stealthy malicious reconnaissance, ensuring early detection of potential tool misuse before it escalates into a broader compromise.

YARA Rule

rule HKTL_NET_GUID_SharpSocks {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/nettitude/SharpSocks"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "2f43992e-5703-4420-ad0b-17cb7d89c956" ascii nocase wide
        $typelibguid1 = "86d10a34-c374-4de4-8e12-490e5e65ddff" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/nettitude/SharpSocks
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the HKTL_NET_GUID_SharpSocks detection rule, including suggested filters and exclusions:

• Scenario: Automated Deployment via PowerShell DSC

  • Context: The enterprise uses Windows Desired State Configuration (DSC) to manage server states. During nightly compliance checks, the DSC engine invokes C#-based modules that generate temporary .NET assemblies with specific typelibguid signatures matching the rule’s heuristic for Red/Black team tools.
  • Filter/Exclusion: Create a process-based exclusion for powershell.exe and dscservice.exe. If the parent process is one of these, suppress the alert unless the command line contains explicit keywords like “SharpSocks” or “RedTeam”.

• Scenario: Microsoft Teams Background Updates

  • Context: The Microsoft Teams client (a heavy C# application) frequently runs background update tasks and telemetry collection services. These internal processes often instantiate .NET components that share the same typelibguid patterns identified by the rule as potential security tools, triggering alerts during off-hours when users are inactive.
  • Filter/Exclusion: Exclude file paths containing \Microsoft Teams\ or process names Teams.exe, TeamsUpdate.exe, and TeamsMachineWideInstaller.exe. Additionally, filter out events occurring between 02:00 and 05:00 local time to account for scheduled maintenance windows.

• Scenario: CI/CD Pipeline Artifact Generation

  • Context: The DevOps team runs a Jenkins or Azure DevOps agent on build servers that compiles C# libraries nightly. During the artifact generation phase, the build agents utilize standard .NET SDKs which register typelibguid entries identical to those used by the targeted Red/Black tools, causing high-volume false positives during build cycles.