Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies the execution of specialized C# Red and Black team security tools by analyzing unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these artifacts is essential to distinguish legitimate security testing activities from potential adversary use of custom C# utilities that may mimic trusted tooling behavior.

YARA Rule

rule HKTL_NET_GUID_SharpCookieMonster {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/m0rv4i/SharpCookieMonster"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "566c5556-1204-4db9-9dc8-a24091baaa8e" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/m0rv4i/SharpCookieMonster
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid”, including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build servers (e.g., Jenkins, Azure DevOps) frequently invoke .NET-based compilation or testing frameworks which register specific TypeLibGuids during the build process. Tools like NUnit, xUnit, or MSBuild often trigger this rule when they load assemblies containing Red/Black team signatures.
  • Filter/Exclusion: Exclude the ComputerName of known CI/CD agents (e.g., Jenkins-Agent-01, AzureDevOps-Build-Node) from the alert logic, or filter out events where the parent process is msbuild.exe or dotnet.exe.

• Scenario: Scheduled Endpoint Security Scans

  • Context: Enterprise EDR agents (such as CrowdStrike Falcon, SentinelOne, or Carbon Black) perform scheduled internal scans using C# components to analyze file integrity. These scanners often load specific TypeLibGuids associated with security tooling libraries, mimicking the behavior of Red Team tools.
  • Filter/Exclusion: Create an exclusion list for known EDR service processes (e.g., C:\Program Files\CrowdStrike\fsqa.exe) and exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 daily) where these scans are triggered.

• Scenario: Office Add-in Deployment via Group Policy

  • Context: IT administrators deploy custom C# add-ins for Microsoft Office (Word/Excel) or Outlook to users via Group Policy. These add-ins often utilize TypeLibGuids that overlap with those used by security testing tools, particularly when