Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies potential adversary activity by detecting the execution of known .NET-based red and blue team tools through process name analysis. Proactively hunting for these indicators in Azure Sentinel allows the SOC to distinguish between legitimate security testing operations and malicious tool usage that may mimic trusted processes to evade detection.

YARA Rule

rule HKTL_NET_NAME_AmsiBypass {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/0xB455/AmsiBypass"
		hash = "8fa4ba512b34a898c4564a8eac254b6a786d195b"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "AmsiBypass" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/0xB455/AmsiBypass
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters or exclusions:

• Scenario: Automated Vulnerability Scanning

  • Context: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) often utilize built-in .NET agents to perform asset discovery and configuration checks. These agents frequently spawn processes with names matching known security tooling patterns (e.g., NessusAgent.exe, QualysPCAP.exe).
  • Filter/Exclusion: Create an exclusion based on the specific executable path of the scanner agent (e.g., C:\Program Files\Tenable\Nessus\bin\nessus.exe) and restrict detection to non-scan hours or exclude known service accounts running these agents.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Many enterprise backup solutions (such as Veeam, Commvault, or Rubrik) rely on .NET-based command-line utilities for data compression, encryption, and transfer tasks. These scheduled jobs often run under the SYSTEM account with process names like VeeamBackupService.exe or CmAgent.exe, which can mimic red-team tool signatures.
  • Filter/Exclusion: Filter out events where the parent process is a known backup service (e.g., Veeam.Backup.Service.exe) and the user context is a dedicated backup service account (e.g., DOMAIN\BackupSvc).

• Scenario: Endpoint Detection & Response (EDR) Self-Scanning

  • Context: Modern EDR platforms like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint utilize .NET components to perform real-time monitoring, telemetry collection, and local policy enforcement.