Detects VB.NET red/black-team tools via typelibguid

Hunt Hypothesis

This rule identifies potential adversary activity by detecting specific TypelibGUID signatures associated with common VB.NET tools used in both offensive and defensive operations within Azure Sentinel. Proactive hunting for these indicators is essential to distinguish legitimate administrative tooling from malicious reconnaissance or post-exploitation activities that leverage standard .NET frameworks to evade signature-based detection.

YARA Rule

rule HKTL_NET_GUID_njRAT {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/mwsrc/njRAT"
        author = "Arnim Rupp"
        date = "2020-12-30"
    strings:
        $typelibguid0 = "5a542c1b-2d36-4c31-b039-26a88d3967da" ascii nocase wide
        $typelibguid1 = "6b07082a-9256-42c3-999a-665e9de49f33" ascii nocase wide
        $typelibguid2 = "c0a9a70f-63e8-42ca-965d-73a1bc903e62" ascii nocase wide
        $typelibguid3 = "70bd11de-7da1-4a89-b459-8daacc930c20" ascii nocase wide
        $typelibguid4 = "fc790ee5-163a-40f9-a1e2-9863c290ff8b" ascii nocase wide
        $typelibguid5 = "cb3c28b2-2a4f-4114-941c-ce929fec94d3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• https://github.com/mwsrc/njRAT
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects VB.NET red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Legitimate deployment of Microsoft Visual Studio or .NET SDK on developer workstations.

  • Context: When developers install or update Visual Studio (2019/2022) or the .NET runtime, the installer registers standard VB.NET type libraries that match the rule’s GUID signatures. This often triggers alerts during office hours when IT pushes updates via SCCM or Intune.
  • Suggested Filter: Exclude processes where ProcessName matches devenv.exe, msbuild.exe, or dotnet.exe running under user accounts within the “Developers” AD group, specifically if the parent process is a known installer (e.g., msiexec.exe).

• Scenario: Scheduled backup jobs utilizing VB.NET-based agents.

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often use .NET components for their agent services. During scheduled maintenance windows, these agents register typelibguids to manage data streams, mimicking the behavior of red-team tools.
  • Suggested Filter: Create an exclusion based on ProcessPath containing specific backup vendor directories (e.g., C:\Program Files\Veeam\Backup and Replication\Agent) or exclude events occurring during the defined maintenance window (e.g., 02:00–04:00 local time).

• Scenario: Execution of internal administrative reporting tools.

  • Context: Many organizations use custom VB.NET applications for HR, Finance, or Asset Management that run as scheduled tasks to generate daily reports. These tools often load the same typelibguids used by security testing frameworks when initializing their UI or background services.