Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these specific tool identifiers allows the SOC to distinguish between authorized security operations and unauthorized reconnaissance or post-exploitation activities that may otherwise blend into routine system noise.

YARA Rule

rule HKTL_NET_GUID_SharpStat {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/Raikia/SharpStat"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "ffc5c721-49c8-448d-8ff4-2e3a7b7cc383" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/Raikia/SharpStat
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters:

• Scenario: Microsoft Office Add-ins and COM Interop

  • Context: Legitimate business applications (e.g., Excel macros, Outlook add-ins) often utilize C# components that register specific TypeLib GUIDs during installation or runtime. These can mimic the signature of Red/Teaming tools like SharpUp or PowerSploit.
  • Filter/Exclusion: Exclude processes where the parent process is EXCEL.EXE, OUTLOOK.EXE, or WINWORD.EXE located in standard Office installation paths (e.g., C:\Program Files\Microsoft Office\).

• Scenario: Automated Backup and Monitoring Agents

  • Context: Enterprise backup solutions (such as Veeam, Commvault, or System Center Operations Manager) run scheduled C# agents that scan the registry and file system. These agents frequently instantiate TypeLib GUIDs associated with .NET reflection libraries used by security tools.
  • Filter/Exclusion: Create an exclusion for known service executables (e.g., vcagent.exe, scmon.exe) running under the SYSTEM or specific service accounts, specifically when triggered during defined maintenance windows (e.g., 02:00–04:00).

• Scenario: Endpoint Detection and Response (EDR) Scanning

  • Context: The organization’s primary EDR solution (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) performs continuous behavioral analysis using C# modules. These internal scanners often generate the same TypeLib GUIDs as external Red Team tools during their own threat hunting cycles.
  • Filter/Exclusion: Exclude events where the process image path contains the EDR vendor’s