Detects .NET red/black-team tools via name

Hunt Hypothesis

This detection identifies the execution of known .NET-based security testing utilities by monitoring process names associated with Red and Black team operations. Proactively hunting for these tools in Azure Sentinel allows the SOC to distinguish legitimate security assessments from potential adversary activity that mimics standard diagnostic or penetration testing behaviors.

YARA Rule

rule HKTL_NET_NAME_ConfuserEx {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/yck1509/ConfuserEx"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "ConfuserEx" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/yck1509/ConfuserEx
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/black-team tools via name”, including suggested filters and exclusions:

• Scenario: A scheduled backup job utilizes a custom .NET wrapper named RedTeam_Scan.exe to verify data integrity before archiving.

  • Filter/Exclusion: Exclude the process path if it resides in a dedicated backup directory (e.g., C:\Program Files\BackupAgent\Jobs\) and the parent process is the backup service (BackupEngineService.exe).

• Scenario: The IT Helpdesk runs a routine deployment script using a tool named BlackTeam_Audit.dll to check user permissions on the domain controller.

  • Filter/Exclusion: Create an exclusion for processes launched by known administrative accounts (e.g., DOMAIN\IT-Admin, DOMAIN\HelpDesk) where the command line contains specific flags like /mode=audit.

• Scenario: A third-party vulnerability scanner named RedTeam_HealthCheck.exe is installed on a file server to monitor disk health and network latency.

  • Filter/Exclusion: Exclude the tool if it runs as a Windows Service (Service Name: RTHC_Service) rather than being launched interactively by a user session, or filter by the specific installation path C:\Tools\VulnScan\.

• Scenario: Developers in the R&D department use a custom .NET utility named BlackTeam_LogParser.exe to aggregate application logs during nightly maintenance windows.

  • Filter/Exclusion: Implement a time-based filter to exclude detections occurring between 01:00 and 05:00 on weekdays, or restrict the scope to specific host groups tagged as “R&D-DevServers”.

• Scenario: The security team deploys a .NET agent named `RedTeam_M