Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that register unique TypeLibGuid identifiers to establish persistence or execute reconnaissance within the Azure environment. Proactively hunting for these specific artifacts in Azure Sentinel is critical because their presence often indicates authorized security testing, yet they can also serve as a stealthy foothold for attackers mimicking legitimate tooling to evade standard signature-based detections.

YARA Rule

rule HKTL_NET_GUID_SharpSpray {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/jnqpblc/SharpSpray"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "51c6e016-1428-441d-82e9-bb0eb599bbc8" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/jnqpblc/SharpSpray
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID,” along with suggested filters or exclusions:

• Scenario: Automated Patch Management Deployment

  • Context: Enterprise patch management systems (e.g., Microsoft Endpoint Configuration Manager (MECM) or Ivanti) utilize C# agents to scan and deploy updates. These agents often instantiate specific COM objects with unique TypelibGUIDs that overlap with known red-team tool signatures during the installation phase of security software updates.
  • Suggested Filter: Exclude processes originating from the patch management service account (e.g., NT SERVICE\ccmexec) and restrict detection to paths outside the standard system update directories (C:\Program Files\Microsoft Endpoint Configuration Manager).

• Scenario: Internal IT Support Remote Assistance

  • Context: Helpdesk analysts frequently use internal C#-based remote support tools (e.g., a custom wrapper around BeyondTrust or TeamViewer Enterprise) to troubleshoot user workstations. These tools load specific libraries for screen capture and file transfer that share TypelibGUIDs with common offensive frameworks like Cobalt Strike or Empire.
  • Suggested Filter: Create an exclusion based on the parent process name (e.g., RemoteAssist.exe) and limit alerts to non-business hours if the tool is known to be used primarily for scheduled maintenance windows.

• Scenario: Scheduled Compliance Scans

  • Context: Automated compliance auditing tools (such as Qualys Cloud Agent or a custom internal C# script running via Task Scheduler) perform periodic inventory checks. These scans often enumerate installed software and registry keys, triggering the TypelibGUID associated with security assessment frameworks during their daily 2:00 AM execution window.
  • **S