Detects VB.NET red/black-team tools via typelibguid

Hunt Hypothesis

This hunt hypothesis identifies adversaries leveraging custom VB.NET tools for reconnaissance or post-exploitation by analyzing unique typelib GUID signatures often used in red and black team engagements. Proactively hunting for these indicators within Azure Sentinel enables the SOC to distinguish between legitimate administrative automation and potential stealthy adversary activity that may evade standard process-based detections.

YARA Rule

rule HKTL_NET_GUID_BlackNET {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/BlackHacker511/BlackNET"
        author = "Arnim Rupp"
        date = "2020-12-30"
    strings:
        $typelibguid0 = "c2b90883-abee-4cfa-af66-dfd93ec617a5" ascii nocase wide
        $typelibguid1 = "8bb6f5b4-e7c7-4554-afd1-48f368774837" ascii nocase wide
        $typelibguid2 = "983ae28c-91c3-4072-8cdf-698b2ff7a967" ascii nocase wide
        $typelibguid3 = "9ac18cdc-3711-4719-9cfb-5b5f2d51fd5a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://github.com/BlackHacker511/BlackNET
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects VB.NET red/black-team tools via typelibguid rule, including suggested filters and exclusions:

• Scenario: Legitimate deployment of Microsoft Office Add-ins or COM components.

  • Context: When IT administrators install or update Office add-ins (e.g., Power BI Desktop, SharePoint Designer), the installation process often registers VB.NET-based TypeLibs that match the GUID patterns used by security tools like Mimikatz or Bloodhound.
  • Filter/Exclusion: Exclude processes originating from the Microsoft Office installation directory (C:\Program Files\Microsoft Office...) and specifically filter out parent processes named msiexec.exe or setup.exe running under the context of a known deployment service account (e.g., DOMAIN\DeploySvc).

• Scenario: Scheduled backup jobs utilizing VB.NET wrappers.

  • Context: Enterprise backup solutions (such as Veeam Backup & Replication or Commvault) often use VB.NET scripts to interact with system COM objects during nightly windows, triggering the typelib GUID detection logic.
  • Filter/Exclusion: Create a time-based exclusion for events occurring between 01:00 and 05:00 on weekdays where the parent process is vbruntime.exe or commvault_agent.exe, and the user context matches the backup service account (e.g., DOMAIN\BackupAdmin).

• Scenario: Execution of internal HR or Finance reporting tools.

  • Context: Custom in-house applications built on the .NET Framework (VB.NET) for payroll processing or inventory management often load specific TypeLibs at startup that collide with Red Team tool signatures.
  • Filter/Exclusion: Exclude events where the executable path contains specific internal application folders (e.g., `C:\Apps\HR_System\