Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies the execution of specialized C# Red and Black team security tools by monitoring for unique TypeLibGUID signatures within Azure Sentinel logs. Proactively hunting for these artifacts enables the SOC to distinguish legitimate security testing activities from potential adversary use of similar custom C# utilities, thereby reducing false positives and enhancing visibility into internal tooling usage.

YARA Rule

rule HKTL_NET_GUID_SharpFruit {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/rvrsh3ll/SharpFruit"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "3da2f6de-75be-4c9d-8070-08da45e79761" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/rvrsh3ll/SharpFruit
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” along with suggested filters or exclusions:

• Scenario: Automated .NET Deployment Pipelines

  • Context: CI/CD agents (e.g., Azure DevOps, Jenkins) executing msbuild or custom C# deployment scripts on build servers often initialize COM interfaces that generate the same typelib GUIDs as security tools.
  • Filter/Exclusion: Exclude processes running under specific service accounts (e.g., NT SERVICE\BuildAgent) and restrict detection to non-build server hostnames using a regex like ^(?!.*-BUILD-).*.

• Scenario: Enterprise Endpoint Management Agents

  • Context: Tools like Microsoft Intune, SCCM (System Center Configuration Manager), or Ivanti utilize C# components for policy enforcement and inventory scanning. These agents frequently instantiate the same typelib GUIDs as Red Team tools during scheduled health checks.
  • Filter/Exclusion: Create an exclusion list for known legitimate process paths, such as C:\Program Files (x86)\Microsoft Intune Agent\ or C:\Windows\CCM\, and filter out events where the parent process is a well-known management daemon (e.g., ccmexec.exe).

• Scenario: Scheduled Office 365/Exchange Maintenance Jobs

  • Context: Microsoft Exchange Server and Office 365 ProPlus background services often run C# scripts for mailbox maintenance, migration, or update checks. These tasks trigger COM events that mimic the signature of Red Team reconnaissance tools.
  • Filter/Exclusion: Exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) and filter by process name Microsoft.Exchange.ServiceHost.exe or `