Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red and black team tools that generate unique typelibguid artifacts to establish persistence or conduct reconnaissance within the environment. Proactively hunting for these specific identifiers in Azure Sentinel is critical because they often represent legitimate security tooling masquerading as malicious activity, requiring analysts to distinguish between authorized operations and potential adversary use of similar frameworks.

YARA Rule

rule HKTL_NET_GUID_SharpC2 {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/SharpC2/SharpC2"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "62b9ee4f-1436-4098-9bc1-dd61b42d8b81" ascii nocase wide
        $typelibguid1 = "d2f17a91-eb2d-4373-90bf-a26e46c68f76" ascii nocase wide
        $typelibguid2 = "a9db9fcc-7502-42cd-81ec-3cd66f511346" ascii nocase wide
        $typelibguid3 = "ca6cc2ee-75fd-4f00-b687-917fa55a4fae" ascii nocase wide
        $typelibguid4 = "a1167b68-446b-4c0c-a8b8-2a7278b67511" ascii nocase wide
        $typelibguid5 = "4d8c2a88-1da5-4abe-8995-6606473d7cf1" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/blue-team tools via typelibguid”, including suggested filters and exclusions:

Scenario: Automated Vulnerability Scanning with Microsoft Baseline Security Analyzer (MBSA) or Qualys Agent
- Context: Enterprise endpoint protection agents often utilize C# libraries to query the local registry for software inventory. When tools like the Qualys CloudAgent or legacy MBSA scanners run, they instantiate specific .NET assemblies that register a unique typelibguid matching the rule’s signature, even though no adversarial activity is occurring.
- Suggested Filter: Exclude processes where the parent process is the known security agent service (e.g., qualyspc.exe, mbsa.exe) and the command line contains flags related to “inventory,” “scan,” or “asset-discovery.”
Scenario: Scheduled PowerShell Maintenance Scripts using .NET Interop
- Context: System administrators frequently deploy scheduled tasks (Task Scheduler) that execute PowerShell scripts wrapping C# DLLs for system health checks, log rotation, or patch validation. These scripts often load standard Red/Blue team utility libraries (such as System.Management.Automation modules extended by internal C# tools) which generate the specific GUID upon execution.
- Suggested Filter: Create an exclusion for processes launched by TaskSchedulerService where the executable path resides in a dedicated administrative folder (e.g., C:\ProgramData\CorpAdmin\ScheduledTasks) and the user context is a known service account (e.g., CORP-ADMIN-SVC).
Scenario: Deployment of Microsoft Endpoint Configuration Manager (SCCM/MECM) Updates
- Context: During major OS updates or application deployments, the SCCM client (ccmexec.exe) invokes C# helper tools to manage software installation