Detects .NET red/black-team tools via name

Hunt Hypothesis

This detection targets adversaries leveraging custom or known .NET-based offensive and defensive tools that can be identified through specific filename patterns recognized by YARA rules. Proactively hunting for these artifacts in Azure Sentinel is essential to uncover stealthy reconnaissance activities and potential tool deployment during the early stages of an attack lifecycle, even when traditional behavioral indicators are absent.

YARA Rule

rule HKTL_NET_NAME_Aggressor {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/k8gege/Aggressor"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "Aggressor" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/k8gege/Aggressor
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the HKTL_NET_NAME_Aggressor rule, along with suggested filters and exclusions:

• Scenario: Automated Patch Management via Microsoft SCCM

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) frequently launches .NET-based deployment agents or custom scripts during scheduled maintenance windows. These processes often spawn child processes with filenames like Microsoft.Update.Client.exe or generic tool names matching the rule’s pattern, triggering alerts even though they are part of standard infrastructure operations.
  • Suggested Filter: Exclude alerts where the parent process is ccmexec.exe and the execution path resides within the C:\Windows\CCM\ directory.

• Scenario: Internal DevOps Build Pipelines (Jenkins/GitLab Runners)

  • Context: In a hybrid enterprise environment, on-premise build agents (e.g., Jenkins or GitLab Runner) execute .NET compilation and testing tools as part of continuous integration pipelines. Tools such as dotnet.exe, MSBuild.exe, or custom internal utilities named BuildAggregator.dll are launched by the runner service, mimicking red-team tool behavior due to their .NET nature and specific naming conventions.
  • Suggested Filter: Apply a whitelist exclusion for processes running under the user context of the build service account (e.g., DOMAIN\JenkinsService) or restrict detection to exclude paths containing \BuildAgents\ or \GitLab\.

• Scenario: Scheduled Antivirus and EDR Scanning Tasks

  • Context: Enterprise Endpoint Detection and Response (EDR) solutions often utilize .NET-based components for heuristic scanning and policy enforcement. A scheduled task running a tool like SentinelOne.Agent.exe or CrowdStrike.FalconService.exe may spawn child processes with names