Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these specific tool identifiers allows the SOC team to distinguish between legitimate security operations and malicious reconnaissance or lateral movement attempts that mimic standard administrative utilities.

YARA Rule

rule HKTL_NET_GUID_SharpWitness {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rasta-mouse/SharpWitness"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "b9f6ec34-4ccc-4247-bcef-c1daab9b4469" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/rasta-mouse/SharpWitness
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated Build Pipelines (Jenkins/GitLab CI)

  • Context: Continuous Integration servers frequently execute C# compilation tasks using msbuild.exe or custom build agents. These processes often instantiate .NET assemblies that register specific Type Library GUIDs identical to those used by Red Team simulation tools (e.g., SharpUp, BloodHound).
  • Filter/Exclusion: Exclude process paths containing \Jenkins\, \GitLab\runner\, or \AzureDevOps\ and filter for parent processes named msbuild.exe or dotnet.exe.

• Scenario: Endpoint Protection Scanning (CrowdStrike/SentinelOne)

  • Context: Modern EDR agents utilize C# libraries for behavioral analysis and policy enforcement. The background scanning service often loads a Type Library GUID that overlaps with Black Team tools like SharpView or Lateral-Tool. This triggers alerts during routine full-system scans.
  • Filter/Exclusion: Create an exclusion based on the process image path matching known EDR binaries (e.g., C:\Program Files\CrowdStrike\csagent.exe) and exclude events where the parent process is the EDR service itself.

• Scenario: Scheduled System Health Checks

  • Context: Enterprise environments often run scheduled PowerShell jobs or custom C# scripts for asset inventory and health monitoring (e.g., running Get-ADUser via a wrapper). These scripts may utilize the same underlying .NET Type Library GUIDs as forensic tools like Rubeus or PowerSploit.
  • Filter/Exclusion: Exclude events occurring during defined maintenance windows (e.g., 0