Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies active C# Red and Black team security tools by analyzing unique TypeLibGUID signatures within Azure Sentinel logs to distinguish legitimate testing activities from potential adversary tooling. Proactively hunting for these indicators allows the SOC team to validate authorized security operations while rapidly detecting unauthorized or anomalous use of similar C# frameworks that could signal stealthy reconnaissance or lateral movement attempts.

YARA Rule

rule HKTL_NET_GUID_SharpWMI {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/GhostPack/SharpWMI"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/GhostPack/SharpWMI
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the Detects c# red/black-team tools via typelibguid rule:

• Scenario: Automated Software Deployment via Microsoft Endpoint Configuration Manager (SCCM) or Intune.

  • Context: During scheduled maintenance windows, deployment agents utilize C# based components to install updates, which instantiate specific TypeLibGUIDs associated with the deployment engine rather than a security tool.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the ParentProcessName is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the CommandLine contains keywords like “Install”, “Update”, or “Deployment”.

• Scenario: Execution of Microsoft Visual Studio Build Agents on CI/CD Servers.

  • Context: In enterprise DevOps environments, Azure DevOps or Jenkins agents running C# build tasks (e.g., MSBuild) frequently load TypeLibGUIDs associated with .NET runtime libraries that overlap with Red Team tool signatures during compilation phases.
  • Filter/Exclusion: Exclude alerts originating from known CI/CD server hostnames (e.g., ci-server-01, jenkins-node) or where the ProcessName is msbuild.exe and the execution occurs within a dedicated “Build” user context (e.g., NT SERVICE\TeamFoundationBuildAgent).

• Scenario: Scheduled PowerShell Automation Scripts utilizing .NET Assemblies.

  • Context: IT Operations teams often run nightly PowerShell scripts that load custom C# assemblies for reporting or system health checks, triggering the TypeLibGUID detection logic even though no Red/Blue team activity is occurring.
  • Filter/Exclusion: Implement a filter to suppress alerts where the ProcessName is pwsh.exe (or powershell.exe) and