Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that register unique typelibguid values to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel allows the SOC team to distinguish between authorized security engineering activities and potential adversary tooling, ensuring early visibility into low-severity but high-fidelity indicators of compromise.

YARA Rule

rule HKTL_NET_GUID_SharpBlock {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/CCob/SharpBlock"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "3cf25e04-27e4-4d19-945e-dadc37c81152" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/CCob/SharpBlock
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM/MECM

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) frequently invokes C#-based deployment agents to install or update enterprise software. These agents often load specific TypeLib GUIDs associated with red/blue team simulation tools if those tools are part of the standard OS image or a shared library path, even when no actual security exercise is occurring.
  • Suggested Filter: Exclude events where the ParentImage is C:\Windows\CCM\ccmexec.exe and the CommandLine contains keywords like /install, /update, or SoftwareDistribution.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise Endpoint Detection and Response (EDR) or antivirus solutions (e.g., CrowdStrike, Symantec, or Microsoft Defender for Endpoint) utilize C# components to scan and update signature databases. During the daily scheduled maintenance window, these services may instantiate TypeLib GUIDs that overlap with known red-team tool signatures as part of their internal telemetry or reporting modules.
  • Suggested Filter: Create an exclusion for processes running under the SYSTEM account during defined business hours (e.g., 02:00–04:00) where the ImageFileName matches known AV services (e.g., MsMpEng.exe, CsaAgentService.exe).

• Scenario: Microsoft Office Add-in Initialization

  • Context: In environments heavily reliant on Microsoft 365, users launching Outlook or Excel often trigger C# add-ins for compliance, document management, or collaboration (e.g., SharePoint integration tools). These add-ins