Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based red or black team tools that expose unique TypeLib GUIDs to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific artifacts in Azure Sentinel is critical because their presence often indicates advanced tooling usage that may bypass standard signature-based detections, allowing analysts to distinguish between legitimate administrative activities and potential adversary footprinting.

YARA Rule

rule HKTL_NET_GUID_SharpKatz {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/b4rtik/SharpKatz"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "8568b4c1-2940-4f6c-bf4e-4383ef268be9" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/b4rtik/SharpKatz
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects C# Red/Black-Team Tools via TypelibGUID”, including suggested filters or exclusions:

• Scenario: Automated Software Deployment via SCCM/Microsoft Endpoint Configuration Manager

  • Context: System Center Configuration Manager (SCCM) frequently executes C#-based deployment agents and custom PowerShell scripts wrapped in .NET assemblies to push updates. These processes often instantiate COM objects that generate typelibguid entries indistinguishable from red team tools like Cobalt Strike or Empire.
  • Suggested Filter: Exclude the specific process names associated with SCCM (e.g., ccmexec.exe, CcmExec.exe) and their child processes when they are running under the NT SERVICE\CCMEXEC or Local System account on management servers and distribution points.

• Scenario: Scheduled Antivirus Real-Time Scanning and Heuristic Analysis

  • Context: Enterprise Endpoint Detection and Response (EDR) solutions, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, utilize C# components to perform deep heuristic scanning. During scheduled scans, these tools load various COM libraries that trigger the typelibguid signature, mimicking the behavior of black-team reconnaissance utilities.
  • Suggested Filter: Create an exclusion based on the parent process image path (e.g., paths containing \Program Files\Microsoft Defender\Antivirus\) and specific known typelibguid values associated with the vendor’s core scanning engine libraries.

• Scenario: Microsoft Office Background Services and Add-in Initialization

  • Context: In environments where users run heavy Office suites, background services like OfficeClickToRun.exe or specific third-party add-ins (e.g., Adobe Acrobat Pro integration) load C# assemblies that register type libraries. This is particularly common during user logon events when Outlook