Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt targets adversaries leveraging C#-based Red and Black team tools that expose unique TypeLibGUID artifacts to evade standard signature-based detection. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because it enables the SOC team to identify sophisticated reconnaissance or post-exploitation activities that often bypass initial low-severity alerts.

YARA Rule

rule HKTL_NET_GUID_SharpShell {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/cobbr/SharpShell"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "bdba47c5-e823-4404-91d0-7f6561279525" ascii nocase wide
        $typelibguid1 = "b84548dc-d926-4b39-8293-fa0bdef34d49" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/cobbr/SharpShell
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scheduled .NET Framework Health Checks

  • Scenario: Enterprise maintenance scripts (e.g., PowerShell or Python wrappers) periodically invoke mscorsvw.exe or specific diagnostic utilities to verify the integrity of the .NET runtime on servers. These tools often instantiate standard C# assemblies that share common Type Library GUIDs with known red-team frameworks like Cobalt Strike’s Beacon or Empire, triggering alerts during routine maintenance windows.
  • Filter/Exclusion: Create an exclusion for process paths matching C:\Windows\Microsoft.NET\Framework* and C:\Program Files (x86)\Microsoft.NET\Framework*. Additionally, filter out events occurring between 02:00–04:00 UTC on weekdays if these checks are known to be scheduled during off-hours.

• Deployment of Internal C# Management Agents

  • Scenario: Organizations often deploy custom or third-party management agents (e.g., a proprietary “IT Asset Manager” or a specific SCCM extension) written in C#. When these agents update their configuration or perform inventory scans, they load internal libraries that utilize the same Type Library GUIDs as popular blue-team tools like Sysmon or red-team frameworks.
  • Filter/Exclusion: Exclude process names associated with known internal management suites (e.g., AssetAgent.exe, SCCMClientService.exe) and filter by specific parent processes such as TaskScheduler or ccmexec.exe. Verify the SHA-256 hash of the executable against a whitelist of approved internal binaries.

• Microsoft Office Add-in Initialization

  • Scenario: Users frequently launch Microsoft Office applications (Outlook, Excel) with enabled C# add-ins for compliance, document