Detects c# red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects the execution of C#-based red and black team tools by identifying specific TypeLibGUID signatures often associated with security testing or reconnaissance activities. Proactively hunting for these indicators in Azure Sentinel allows the SOC to distinguish between legitimate security operations and potential adversary use of similar tooling, ensuring that stealthy threat actors leveraging standard development environments are not overlooked.

YARA Rule

rule HKTL_NET_GUID_EvilFOCA {
    meta:
        description = "Detects c# red/black-team tools via typelibguid"
        reference = "https://github.com/ElevenPaths/EvilFOCA"
        author = "Arnim Rupp"
        date = "2020-12-28"
    strings:
        $typelibguid0 = "f26bdb4a-5846-4bec-8f52-3c39d32df495" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/ElevenPaths/EvilFOCA
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects C# Red/Black-Team Tools via TypelibGUID” rule, including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Jenkins or Azure DevOps) running dotnet CLI tools to compile and test C# applications often invoke standard .NET assemblies that share the same TypelibGUIDs as security tools.
  • Filter/Exclusion: Exclude processes where the parent process is a known CI service account (e.g., Jenkins.exe, VSTS.Agent.exe) or restrict detection to non-build server IP ranges.

• Scenario: Microsoft Teams and Office 365 Background Updates

  • Context: The Microsoft Teams desktop client (Teams.exe) and Office background services frequently load C# assemblies for add-in management that utilize TypelibGUIDs identical to those used by Red Team simulation tools (e.g., SharpUp, BloodHound).
  • Filter/Exclusion: Create an exclusion rule based on the specific Image Path of Microsoft Office and Teams installation directories (e.g., C:\Users\*\AppData\Local\Microsoft\Teams\current\*) to ignore their assembly loading events.

• Scenario: Scheduled PowerShell Maintenance Jobs

  • Context: Enterprise scheduled tasks running PowerShell scripts that invoke C# libraries for inventory or patch management often trigger the same GUIDs detected by tools like SharpHound or PowerSploit.
  • Filter/Exclusion: Filter out events where the command line arguments contain keywords specific to internal maintenance (e.g., “Inventory,” “PatchCheck”) and the process owner is a local system account (NT AUTHORITY\SYSTEM) rather than an interactive user.

• **Scenario: Endpoint DLP and Ant