Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based red and blue team utility names to distinguish legitimate security testing activities from potential adversary use of similar frameworks for lateral movement or command-and-control operations. Proactive hunting is essential in Azure Sentinel to establish a baseline of authorized tool usage, enabling analysts to quickly differentiate between expected security exercises and suspicious deviations that may indicate an active threat leveraging .NET processes to evade detection.

YARA Rule

rule HKTL_NET_NAME_directInjectorPOC {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/badBounty/directInjectorPOC"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "directInjectorPOC" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/red-black-team tools via name,” along with suggested filters and exclusions:

Scenario: Automated Backup Jobs Executing .NET Utilities
- Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize underlying .NET agents or helper processes to manage data snapshots. These processes may be named similarly to security tools like Veeam.Backup.Service.exe or generic names containing “RedTeam” in the path if custom scripts are involved.
- Suggested Filter/Exclusion: Create a whitelist for known backup service paths (e.g., C:\Program Files\Veeam\Backup and Replication\...) and exclude processes where the parent process is a recognized backup engine (e.g., vbr.exe, commvault.exe).
Scenario: CI/CD Pipeline Agents Running .NET Build Tools
- Context: In DevOps environments, build agents (such as Azure DevOps or Jenkins) frequently execute .NET-based tools like dotnet.exe, msbuild.exe, or specific red-team simulation frameworks during the compilation and testing phases. These often mimic the naming conventions of security assessment tools.
- Suggested Filter/Exclusion: Exclude processes running on designated build server hosts (identified by hostname regex, e.g., ^BUILD-SRV-.*$) where the command line contains keywords like “build,” “test,” or “publish” rather than active reconnaissance commands.
Scenario: IT Admin Performing Software Deployment via PowerShell
- Context: System administrators often use PowerShell scripts to deploy software or run health checks, invoking .NET assemblies directly (e.g., PowerShell.exe spawning a custom .exe). If the admin is using a tool named “RedTeam-Deploy” for internal patching,