Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based red and black team tools by monitoring process names that match established security utility signatures. Proactive hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate security operations from adversarial activity that may mimic similar tooling to evade detection or establish persistence.

YARA Rule

rule HKTL_NET_NAME_CACTUSTORCH {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "CACTUSTORCH" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/mdsecactivebreach/CACTUSTORCH
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters and exclusions:

• Scenario: Automated Backup Execution

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault utilize .NET-based agents that spawn processes with names resembling security tools (e.g., Veeam.Backup.Service.exe or Commvault.Agent.exe) during scheduled maintenance windows. These often include “red-team” style keywords in their process paths or command lines, triggering the rule despite being standard infrastructure operations.
  • Suggested Filter/Exclusion: Exclude processes where the file path contains \Program Files\Veeam\ or \Commvault\ and the user context is a dedicated service account (e.g., NT SERVICE\VeeamBackup) rather than an interactive logged-in user.

• Scenario: Endpoint Protection Scanning

  • Context: Modern EDR agents such as CrowdStrike Falcon, Carbon Black, or SentinelOne rely heavily on .NET components for policy updates and real-time scanning. Their background services often execute tools named FalconSensor.exe or SentinelOneAgent.exe, which may match the rule’s signature for “red-team” .NET utilities due to shared naming conventions in the security sector.
  • Suggested Filter/Exclusion: Create a whitelist for known EDR vendor process names and exclude any execution where the parent process is the primary EDR service (e.g., FalconService.exe or SentinelOneAgentService.exe).

• Scenario: Internal DevOps Deployment Pipelines

  • Context: CI/CD platforms like Azure DevOps, Jenkins, or internal custom deployment tools often run .NET-based agents on build servers. During deployments, these agents