Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based offensive or defensive tools that expose unique typelibguid identifiers to evade standard signature-based detection. Proactively hunting for these artifacts in Azure Sentinel is critical because identifying known tool signatures early allows the SOC team to distinguish legitimate administrative activity from potential red-team exercises or stealthy initial access attempts before they escalate into higher-severity incidents.

YARA Rule

rule HKTL_NET_GUID_SharpMiniDump {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/b4rtik/SharpMiniDump"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "6ffccf81-6c3c-4d3f-b15f-35a86d0b497f" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/b4rtik/SharpMiniDump
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, including suggested filters and exclusions:

• Microsoft Office Add-in Initialization

  • Scenario: When users launch Microsoft Outlook or Excel with productivity add-ins (e.g., Salesforce for Outlook, DocuSign eSignature, or Adobe Acrobat Pro), the host process loads C# assemblies that register specific TypelibGUIDs. These GUIDs often match known red-team tool signatures because many enterprise tools share common .NET base libraries used by security researchers.
  • Filter/Exclusion: Exclude events where the parent process is OUTLOOK.EXE or EXCEL.EXE and the loaded DLL path contains \Microsoft Office\Office16\ or \Program Files\Common Files\.

• Automated Patch Management Scans

  • Scenario: Scheduled tasks running patch management agents (e.g., Ivanti Endpoint Manager, ManageEngine Desktop Central, or SCCM Client) perform periodic inventory scans. These agents utilize C# components to enumerate installed software and registry keys, generating TypelibGUID events that mimic the behavior of reconnaissance tools like BloodHound or SharpUp.
  • Filter/Exclusion: Create a whitelist for process names associated with known patch management services (e.g., IvantiAgent.exe, SMSHOST.EXE) running under the local system account (NT AUTHORITY\SYSTEM) during scheduled maintenance windows.

• CI/CD Pipeline Build Agents

  • Scenario: In development environments, build servers (e.g., Jenkins, Azure DevOps Agents, or GitLab Runners) execute C# compilation tasks and unit tests. These agents frequently load the .NET SDK and testing frameworks (like NUnit or