nBinder v361

Hunt Hypothesis

This rule detects the presence of nBinder, a lightweight .NET assembly packer often used by adversaries to obfuscate malicious payloads and evade static analysis. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify potentially hidden or modified executables that may be staging for execution or lateral movement within the environment.

YARA Rule

rule nBinder_v361: PEiD
{
    strings:
        $a = { 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C }
        $b = { 6E 73 70 61 63 6B 24 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses nBinder to package a .NET application into a single executable for deployment to a test environment or for sharing with a client. The resulting binary contains the nBinder signature, triggering the detection on the file system or in memory.
  • Filter/Exclusion: Exclude files located in specific development or build directories (e.g., C:\Projects\, C:\Builds\, C:\Artifacts\) or exclude processes where the parent is a known build tool like MSBuild.exe or dotnet.exe and the file extension is .exe or .dll.
• Scenario: An IT administrator uses nBinder to bundle a custom PowerShell script or C# utility into a standalone executable to simplify distribution to remote servers or non-technical users, avoiding the need for .NET Framework installation on the target machines.
  • Filter/Exclusion: Allow execution if the process name matches a known internal utility naming convention (e.g., *.InternalTool.exe) or if the file is located in a trusted administrative tools directory (e.g., C:\AdminTools\, C:\Scripts\).
• Scenario: A security team or QA engineer uses nBinder to create a test executable for verifying that the YARA rule itself is functioning correctly (a “canary” or “honeypot” test file) during rule tuning or validation phases.
  • Filter/Exclusion: Exclude files with specific test naming patterns (e.g., *test*.exe, *canary*.exe, *yara_test*.exe) or exclude files located in a dedicated security testing directory (e.g., C:\SecOps\Tests\, C:\YARA_Signatures\).
• Scenario: A scheduled job or automated deployment pipeline uses nBinder as