Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based Red and Black team tools that generate unique TypeLibGUID artifacts to establish a foothold or conduct reconnaissance within the environment. Proactive hunting for these specific GUID signatures in Azure Sentinel is essential because they often represent early-stage tool deployment that may evade traditional signature-based detections, allowing the SOC team to identify and investigate potential lateral movement or command-and-control activities before escalation occurs.

YARA Rule

rule HKTL_NET_GUID_SharpStay {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xthirteen/SharpStay"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "2963c954-7b1e-47f5-b4fa-2fc1f0d56aea" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/0xthirteen/SharpStay
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: CI/CD agents (e.g., Azure DevOps or Jenkins) running on build servers frequently utilize C# libraries for compilation and testing. The msbuild.exe process often loads specific COM typelib GUIDs associated with Red Team simulation frameworks during the build phase, triggering alerts even though no active attack is occurring.
  • Filter/Exclusion: Exclude processes named msbuild.exe, dotnet.exe, or vstest.console.exe running under service accounts (e.g., NT SERVICE\BuildAgent) on dedicated build server hostnames (e.g., *-BUILD-01).

• Scenario: Scheduled Endpoint Management Scans

  • Context: Enterprise security suites like Microsoft Defender for Endpoint or Qualys often perform scheduled compliance scans using C# agents. These agents load typelib GUIDs to interface with system components, mimicking the behavior of Red Team tools during their nightly maintenance windows (e.g., 02:00–04:00 local time).
  • Filter/Exclusion: Create a time-based exclusion window for processes matching QualysCC.exe or MsMpEng.exe between 01:00 and 05:00 UTC, or exclude specific typelib GUIDs known to belong to the endpoint management vendor.

• Scenario: Active Directory Group Policy Updates

  • Context: When an administrator pushes a new Group Policy Object (GPO) containing C# scripts for configuration management, the gpupdate.exe process invokes COM objects that share typelib GUIDs with common Red Team reconnaissance tools. This is particularly common during weekly policy refresh