Detects VB.NET red/black-team tools via typelibguid

Hunt Hypothesis

This detection identifies the execution of specialized VB.NET Red and Blue team tools by analyzing unique typelib GUID signatures often utilized during security assessments or post-incident forensics. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to distinguish legitimate security operations from potential adversary activity that mimics trusted tooling, ensuring early visibility into both internal testing and external threat reconnaissance efforts.

YARA Rule

rule HKTL_NET_GUID_PlasmaRAT {
    meta:
        description = "Detects VB.NET red/black-team tools via typelibguid"
        reference = "https://github.com/mwsrc/PlasmaRAT"
        author = "Arnim Rupp"
        date = "2020-12-30"
    strings:
        $typelibguid0 = "b8a2147c-074c-46e1-bb99-c8431a6546ce" ascii nocase wide
        $typelibguid1 = "0fcfde33-213f-4fb6-ac15-efb20393d4f3" ascii nocase wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/mwsrc/PlasmaRAT
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects VB.NET red/black-team tools via typelibguid” rule, including suggested filters and exclusions:

• Scenario: Microsoft Office Add-in Deployment

  • Context: During a scheduled deployment of new Excel or PowerPoint add-ins (e.g., Power BI Report Server connectors), the msbuild.exe process compiles VB.NET components that register specific TypeLib GUIDs identical to those used by security testing tools.
  • Suggested Filter/Exclusion: Create an exclusion for processes running under the context of OfficeClickToRun or Microsoft Office Setup where the parent process is msiexec.exe and the file path contains \Program Files\Microsoft Office\.

• Scenario: Internal HR Portal Maintenance Job

  • Context: A nightly scheduled job (Task Scheduler) executes a custom VB.NET application (HR_Portal_Updater.exe) to synchronize employee data. This internal tool utilizes a TypeLib GUID that overlaps with the detection signature for red-team reconnaissance tools like PowerSploit or Rubeus.
  • Suggested Filter/Exclusion: Exclude alerts where the executable path matches \\FileServer\Tools\HR_Portal_Updater.exe and the user context is a dedicated service account (e.g., svc-hr-sync).

• Scenario: Visual Studio Build Server Activity

  • Context: The enterprise CI/CD pipeline triggers a build on TeamCity or Azure DevOps agents. These agents often invoke VB.NET compilers that instantiate TypeLib GUIDs associated with standard .NET testing frameworks, which the rule flags as potential black-team tool usage (e.g., mimicking SharpUp behavior).
  • Suggested Filter/Exclusion: Implement a filter to suppress alerts originating from known build server hostnames (e.g., `BUILD-