Detects VB.NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule detects adversary behavior involving the execution of specialized VB.NET tools commonly used by both red and blue teams for reconnaissance or post-exploitation activities through unique typelib GUID signatures. A SOC team should proactively hunt for these indicators in Azure Sentinel to distinguish between legitimate security operations and potential adversarial tool usage that may otherwise blend into normal background noise, thereby reducing false positives during incident response.

YARA Rule

rule HKTL_NET_GUID_gray_keylogger_2 {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/graysuit/gray-keylogger-2"
        author = "Arnim Rupp"
        date = "2020-12-30"
    strings:
        $typelibguid0 = "e94ca3ff-c0e5-4d1a-ad5e-f6ebbe365067" ascii nocase wide
        $typelibguid1 = "1ed07564-b411-4626-88e5-e1cd8ecd860a" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/graysuit/gray-keylogger-2
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the “Detects VB.NET red/black-team tools via typelibguid” rule, along with suggested filters or exclusions:

• Scenario: Automated Deployment of Microsoft System Center Configuration Manager (SCCM)

  • Context: SCCM agents frequently utilize VB.NET components to deploy software updates and manage inventory. During scheduled maintenance windows, the ccmsetup.exe process often loads specific typelib GUIDs associated with deployment tools that mimic red-team utility signatures.
  • Suggested Filter/Exclusion: Exclude processes where the executable path contains \Microsoft\CCM\ or CcmExec.exe, and restrict detection to non-business hours if the alert volume spikes during known maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Execution of Visual Studio Build Agents on CI/CD Servers

  • Context: Enterprise Continuous Integration servers (such as Azure DevOps or Jenkins) running MSBuild tasks often instantiate VB.NET runtime environments. These agents load typelib GUIDs for debugging and compilation that overlap with the signatures used by red-team reconnaissance tools like SharpHound or Bloodhound.
  • Suggested Filter/Exclusion: Create an exclusion rule for processes spawned under known CI service accounts (e.g., NT SERVICE\TeamFoundationBuildAgent) and filter out alerts where the parent process is msbuild.exe or VSTestPlatform.exe.

• Scenario: Scheduled Internal Security Scanning via PowerShell Modules

  • Context: The internal security team runs nightly compliance scans using custom VB.NET PowerShell modules. These scripts invoke COM objects with typelib GUIDs that are identical to those used by black-team enumeration tools (e.g., PowerSploit or SharpUp).
  • Suggested Filter/Exclusion: