Dotfuscator

Hunt Hypothesis

This rule detects the use of Dotfuscator, a .NET obfuscation tool, which adversaries employ to hide malicious code logic and evade static analysis during post-exploitation activities. Proactively hunting for this behavior in Azure Sentinel allows the SOC to identify potentially stealthy .NET payloads that may be executing in cloud workloads or hybrid environments before they establish persistence or exfiltrate data.

YARA Rule

rule dotfuscator : packer
{
	meta:
		author = "Jean-Philippe Teissier / @Jipe_"
		description = "Dotfuscator"
		date = "2013-02-01"
		filetype = "memory"
		version = "1.0"

	strings:
		$a = "Obfuscated with Dotfuscator"

	condition:
		$a
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or build engineer uses JetBrains dotNetfuscator (or the standalone dotNetfuscator CLI) to obfuscate a .NET application before packaging it for a release candidate or internal testing. This is a standard part of the CI/CD pipeline for commercial or proprietary software to protect intellectual property.
  • Filter/Exclusion: Exclude processes where the parent process is a known build tool (e.g., msbuild.exe, dotnet.exe, nuget.exe, or jenkins-agent.exe) or where the command line contains arguments like /obfuscate, /optimize, or /rename.
• Scenario: An IT administrator or power user runs dotNetfuscator manually to obfuscate a small utility script or a legacy .NET console application that is being migrated to a new server, using the command-line interface directly from PowerShell or CMD.
  • Filter/Exclusion: Exclude executions where the working directory is a known development or staging folder (e.g., C:\Dev\, C:\Staging\, C:\Builds\) or where the user account belongs to a specific AD group (e.g., DevTeam, ReleaseEngineers).
• Scenario: A scheduled task or service on a build server automatically triggers the dotNetfuscator executable as part of a nightly build job to process multiple .NET assemblies in a batch. The process may appear as a standalone executable without an obvious interactive parent.
  • Filter/Exclusion: Exclude processes where the parent process is svchost.exe (if running as a service) or Taskeng.exe (if triggered by Task Scheduler), or where the command line includes a batch file reference (e.g., *.bat, *.ps1) or a list of input .dll/.exe files.