Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity by monitoring for specific TypeLibGUID signatures associated with known C# Red and Black team tools used during penetration testing or post-incident analysis. Proactive hunting for these indicators in Azure Sentinel is essential to distinguish legitimate security operations from potential malicious reconnaissance, ensuring that tool usage by threat actors mimicking authorized teams is not overlooked.

YARA Rule

rule HKTL_NET_GUID_Sharpire {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/0xbadjuju/Sharpire"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "39b75120-07fe-4833-a02e-579ff8b68331" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/0xbadjuju/Sharpire
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects c# red/black-team tools via typelibguid,” along with suggested filters or exclusions:

• Scenario: Automated Deployment Pipeline Execution

  • Context: Continuous Integration/Continuous Deployment (CI/CD) agents (e.g., Jenkins, Azure DevOps Agents) running on build servers frequently invoke C# utilities to compile code or manage artifacts. These tools often load specific COM type libraries that match the rule’s GUID signatures during nightly builds.
  • Filter/Exclusion: Exclude processes originating from known CI/CD service accounts (e.g., NT SERVICE\Jenkins, AZUREDEVOPSAGENT) and restrict detection to non-build server hostnames or exclude specific process paths like C:\Program Files\Azure DevOps Agent\.

• Scenario: Microsoft Office 365 Click-to-Run Updates

  • Context: The background update service for Microsoft Office (OfficeClickToRun.exe) utilizes C# components to manage add-ins and registry keys. These components often instantiate type libraries that mimic the GUIDs used by security testing tools, triggering alerts during routine patching windows.
  • Filter/Exclusion: Create an exclusion rule based on the process image path C:\Program Files\Microsoft Office\root\Office16\ and exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Endpoint Protection Scanning Engine

  • Context: Enterprise antivirus solutions (such as CrowdStrike Falcon or SentinelOne) utilize C# based scanning engines that interact with system type libraries to analyze file integrity and registry changes. The scanning engine’s internal COM interactions often generate the specific typelibguid signatures detected by this rule.
  • Filter/Exclusion: Exclude processes belonging to known