Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based red and black team tools by matching process names against a curated list of security testing utilities. Proactive hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate security assessments from potential adversary activity that mimics tooling behavior to evade detection or establish persistence.

YARA Rule

rule HKTL_NET_NAME_ADCollector {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/dev-2null/ADCollector"
        hash = "5391239f479c26e699b6f3a1d6a0a8aa1a0cf9a8"
        hash = "9dd0f322dd57b906da1e543c44e764954704abae"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "ADCollector" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/dev-2null/ADCollector
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/black-team tools via name,” along with suggested filters or exclusions:

• Scenario: Automated Backup Jobs Using PowerShell

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize .NET-based PowerShell scripts to manage data. These scripts may invoke processes named System.Data.SqlClient or generic .exe names that overlap with red-team tool signatures like SharpUp or PowerShell Empire.
  • Filter/Exclusion: Exclude process paths containing Veeam, Commvault, or specific backup service folders (e.g., C:\Program Files\Veeam\Backup and Replication). Additionally, filter out processes where the parent is a known backup service account (e.g., NT SERVICE\VeeamBRService).

• Scenario: Internal Development Build Pipelines

  • Context: CI/CD agents running on build servers frequently execute .NET compilation tasks using tools like msbuild.exe, dotnet.exe, or internal custom automation scripts. These often mimic the naming conventions of red-team tools such as SharpChmod or PowerShell Empire.
  • Filter/Exclusion: Create an exclusion for process names running on specific host groups (e.g., “Build-Server” AD group) or paths within the CI/CD directory structure (e.g., C:\AzureDevOps\Agent). Filter out events where the command line contains keywords like --restore, publish, or build.

• Scenario: Endpoint Management and Patching Agents

  • Context: Unified Endpoint Management (UEM) tools like Microsoft Intune, SCCM, or Ivanti often deploy .NET-based agents to push patches or inventory data. These agents may spawn processes with names resembling black-team tools like `Sharp