Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging C#-based red and black team tools that generate unique TypeLibGUID artifacts to establish persistence or execute reconnaissance within the environment. Proactively hunting for these specific GUIDs in Azure Sentinel is critical because their low-severity nature often allows them to evade standard alerting thresholds, enabling attackers to maintain a stealthy foothold before escalating to more aggressive actions.

YARA Rule

rule HKTL_NET_GUID_SHAPESHIFTER {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/matterpreter/SHAPESHIFTER"
        author = "Arnim Rupp"
        date = "2020-12-13"
    strings:
        $typelibguid0 = "a3ddfcaa-66e7-44fd-ad48-9d80d1651228" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/matterpreter/SHAPESHIFTER
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects C# Red/Black-Team Tools via TypelibGUID rule, tailored for an enterprise environment:

• Scenario: Automated Patch Management Execution

  • Context: Enterprise deployment tools like Microsoft Endpoint Configuration Manager (MECM) or SCCM frequently execute C# scripts to verify client health and install updates. These processes often load standard .NET libraries that share the same TypelibGUID signatures as known red-team reconnaissance tools (e.g., BloodHound or SharpUp).
  • Filter/Exclusion: Create an exclusion for the specific process path of the patch management agent (e.g., C:\Program Files\Microsoft Configuration Manager\bin\x64\ccmexec.exe) and its child processes, specifically when running scheduled maintenance tasks between 02:00 and 05:00 UTC.

• Scenario: IT Helpdesk Remote Support Sessions

  • Context: Helpdesk administrators utilize remote support tools such as TeamViewer, AnyDesk, or Microsoft Quick Assist. When an agent initiates a session to troubleshoot a user’s workstation, the tool loads C# components for screen capture and file transfer. These components often trigger the detection logic due to overlapping GUIDs associated with system enumeration libraries used by both support tools and black-team asset discovery utilities.
  • Filter/Exclusion: Exclude events where the parent process is identified as a known remote support executable (e.g., TeamViewer_Service.exe, AnyDesk.exe) and the user account belongs to the “IT_Support” or “Helpdesk_Admins” security group, rather than standard domain users.

• Scenario: Scheduled Compliance Auditing Jobs

  • Context: Internal compliance teams run automated C# auditing scripts (often custom-built or based on frameworks like **PowerShell with