Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based Red and Blue team utility names to distinguish between legitimate security operations and potential adversary activity leveraging similar tooling. Proactively hunting for these processes in Azure Sentinel is essential because attackers frequently mimic standard security tools to evade detection, requiring analysts to validate the context of each observed instance against expected operational baselines.

YARA Rule

rule HKTL_NET_NAME_cve_2017_7269_tool {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/zcgonvh/cve-2017-7269-tool"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "cve-2017-7269-tool" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters and exclusions:

Scenario: Automated Backup Jobs Executing Duplicacy or Veeam Agents
- Context: Enterprise backup solutions often run as scheduled tasks during off-hours. Tools like Veeam Agent for Windows or Duplicacy utilize .NET frameworks and may have executable names (e.g., VeeamAgent.exe, duplicacy.exe) that match the pattern of security tools, triggering a false alert when they perform routine snapshot operations.
- Filter/Exclusion: Exclude processes where the parent process is the Windows Task Scheduler (TaskScheduler.exe or svchost.exe) and the file path resides in standard vendor installation directories (e.g., C:\Program Files\Veeam\...).
Scenario: Development Teams Running Local Unit Tests with xUnit or NUnit
- Context: In R&D departments, developers frequently execute local unit test suites using .NET-based frameworks like xUnit or NUnit. These tools often spawn processes named dotnet.exe, nunit3-console.exe, or specific runner binaries that mimic the naming convention of Red/Blue team reconnaissance tools during CI/CD pipeline runs.
- Filter/Exclusion: Filter out events originating from hostnames containing “DEV-” or “BUILD-” prefixes, and exclude processes running under user accounts belonging to the DevTeam security group rather than standard service accounts.
Scenario: Endpoint Protection Scanning via Sysmon or Custom .NET Agents
- Context: Many organizations deploy custom .NET-based agents for endpoint detection and response (EDR) that utilize names similar to Red/Blue team tools (e.g., SentinelOneAgent.exe, `CarbonBlack