Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting C#-based red and black team tools through their unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these specific tool identifiers is essential to distinguish legitimate security testing from malicious reconnaissance or lateral movement attempts that leverage similar C# frameworks.

YARA Rule

rule HKTL_NET_GUID_sharpwmi {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/QAX-A-Team/sharpwmi"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "bb357d38-6dc1-4f20-a54c-d664bd20677e" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/QAX-A-Team/sharpwmi
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Scheduled PowerShell Health Checks

  • Context: Enterprise IT often runs automated daily health checks using custom C# scripts (e.g., HealthMonitor.exe) that query system state. These scripts frequently instantiate .NET assemblies with specific TypeLibGUIDs similar to those used by red-team tools like Cobalt Strike’s Beacon or custom implant frameworks.
  • Filter/Exclusion: Create an exclusion for the specific executable path and hash of known health check agents.
    • Action: Exclude C:\ProgramData\ITOps\Scripts\HealthMonitor.exe (Hash: [SHA256_HASH]) from triggering this rule if the parent process is Task Scheduler (SchTasks.exe).

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Context: The SCCM client (ccmsetup.exe or SMS_TSMClient.exe) utilizes C# components to manage software deployments and inventory. During the installation of new application packages, these components load TypeLibGUIDs that overlap with common red-team tool signatures (e.g., Mimikatz or SharpUp).
  • Filter/Exclusion: Exclude processes belonging to the Microsoft Endpoint Configuration Manager service group.
    • Action: Filter out events where Image contains \Microsoft Endpoint Configuration Manager\ and the command line includes arguments related to “Inventory” or “Deployment”.

• Scenario: Automated Backup Agents (e.g., Veeam or Commvault)

  • Context: Enterprise backup solutions often use C#-based agents to scan file systems and manage snapshots. These agents register TypeLibGUIDs for COM interop that can mimic the GUIDs of black