Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based Red and Black team utility names to distinguish legitimate security operations from potential adversary activity leveraging similar tooling. Proactive hunting for these signals in Azure Sentinel is essential to prevent attackers from masking malicious processes by mimicking trusted security tools, thereby reducing false negatives during incident response.

YARA Rule

rule HKTL_NET_NAME_DotNetAVBypass {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/mandreko/DotNetAVBypass"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "DotNetAVBypass" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/mandreko/DotNetAVBypass
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters and exclusions:

• Scenario: Automated Backup Execution by Veeam or Commvault

  • Context: Enterprise backup solutions often utilize .NET-based agents (e.g., Veeam.Backup.Service.exe or Commvault.Archiver.exe) that run on a strict schedule. These processes frequently invoke internal .NET tools for data indexing and integrity checks, which match the naming patterns of Red/Blue team security utilities.
  • Filter/Exclusion: Create an exclusion based on the Parent Process Name (e.g., vbrservice.exe or cvdbservice.exe) AND the File Path. Exclude any detection where the process path contains \Program Files\Veeam\ or \Commvault\.

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Application Deployment

  • Context: During scheduled application deployments, SCCM launches .NET-based installers and configuration scripts. Tools like AppDeploymentTool.exe or custom .NET wrapper executables often appear in the process tree with names resembling security tooling (e.g., containing “Security”, “Audit”, or “Monitor” in their filenames).
  • Filter/Exclusion: Filter out events where the User Account is a dedicated service account (e.g., DOMAIN\SCCM_SVC or DOMAIN\AppDeploy) AND the Process Command Line contains specific SCCM deployment identifiers (e.g., --deploymentId).

• Scenario: Internal HR and Payroll System Updates (e.g., Workday or SAP SuccessFactors)

  • Context: Many enterprise HR suites run nightly .NET batch jobs to process payroll or update user attributes. These jobs often spawn helper processes named generically, such