Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based Red and Blue team utility names to distinguish legitimate security operations from potential adversary activity leveraging similar tooling. Proactive hunting for these artifacts in Azure Sentinel is essential to reduce false positives from internal testing while uncovering adversaries who mimic trusted security tools to evade detection during reconnaissance or post-compromise phases.

YARA Rule

rule HKTL_NET_NAME_ATPMiniDump {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/b4rtik/ATPMiniDump"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "ATPMiniDump" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/b4rtik/ATPMiniDump
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters or exclusions:

• Scenario: Scheduled Backup Jobs Executing on Domain Controllers

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize .NET-based agents running as scheduled tasks on Domain Controllers. These agents may spawn processes with names resembling security tools (e.g., Veeam.Backup.Service.exe or generic .dll hosts like wuauserv.exe loading specific tooling assemblies).
  • Filter/Exclusion: Exclude process paths containing \Program Files\BackupVendor\ and filter out events where the parent process is a known backup service (e.g., Veeam.Backup.Service.exe) running under the SYSTEM or dedicated BackupService account.

• Scenario: Internal DevOps CI/CD Pipeline Agents

  • Context: Build servers (such as Jenkins, Azure DevOps, or GitLab Runners) frequently execute .NET-based compilation and testing tools within their agent containers or on build nodes. Tools like dotnet.exe, msbuild.exe, or specific unit test runners (e.g., vstest.console.exe) often mimic the naming convention of red/blue team attack simulation tools.
  • Filter/Exclusion: Create an exclusion for process names matching *\.exe located within \Program Files\Jenkins\ or \Azure DevOps Agent\, and restrict detection to exclude processes running under service accounts named BuildAgent or ServiceAccount-CI.

• Scenario: Endpoint Detection and Response (EDR) Self-Scanning

  • Context: Modern EDR platforms (e.g., CrowdStrike, Carbon Black, Microsoft Defender for Endpoint) often include .NET-based modules that perform behavioral analysis