Detects VB.NET red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies adversary activity involving VB.NET-based red and blue team tools by analyzing unique TypeLibGUID signatures within Azure Sentinel logs. Proactive hunting for these indicators is essential to distinguish legitimate security tooling from potential malicious reconnaissance or lateral movement attempts that leverage similar .NET frameworks.

YARA Rule

rule HKTL_NET_GUID_Lime_Miner {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/NYAN-x-CAT/Lime-Miner"
        author = "Arnim Rupp"
        date = "2020-12-30"
    strings:
        $typelibguid0 = "13958fb9-dfc1-4e2c-8a8d-a5e68abdbc66" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://github.com/NYAN-x-CAT/Lime-Miner
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects VB.NET red/black-team tools via typelibguid” detection rule, including suggested filters and exclusions:

• Enterprise Backup Agent Scans

  • Scenario: The Veeam Backup & Replication agent or Commvault Command Center runs scheduled backup jobs that utilize VB.NET components to enumerate file systems. These agents often load specific TypeLib GUIDs (e.g., 00020814-0000-0000-C000-000000000046 for Office or custom COM libraries) during the indexing phase, mimicking the behavior of red-team reconnaissance tools.
  • Filter/Exclusion: Exclude processes with names containing Veeam, CommServe, or BackupAgent running under the context of a dedicated service account (e.g., DOMAIN\svc_backup) from the detection logic.

• Microsoft Office Add-in Initialization

  • Scenario: When users launch Microsoft Outlook or Excel with installed third-party add-ins (such as Adobe Acrobat PDF Maker, DocuSign, or Salesforce Lightning), these applications instantiate VB.NET COM objects during startup. The typelibguid associated with the Office Object Model is frequently triggered by these legitimate business tools rather than offensive security scripts.
  • Filter/Exclusion: Create a whitelist for parent processes matching WINWORD.EXE, EXCEL.EXE, and OUTLOOK.EXE. Additionally, exclude specific TypeLib GUIDs known to be standard Office components (e.g., 000209FF-0000-0000-C000-000000000046).

• Scheduled PowerShell Deployment Scripts

  • Scenario: IT Operations teams often run nightly deployment scripts