Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule detects the execution of known .NET-based red and blue team utility names to identify potential adversary reconnaissance or post-compromise tooling activities within the environment. Proactively hunting for these specific artifacts in Azure Sentinel allows the SOC team to distinguish between legitimate security operations and malicious tool usage that may otherwise blend into normal background noise, thereby reducing false positives while enhancing visibility into attacker tradecraft.

YARA Rule

rule HKTL_NET_NAME_FakeFileMaker {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/FakeFileMaker"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "FakeFileMaker" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/DamonMohammadbagher/FakeFileMaker
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/red-black-team tools via name,” along with suggested filters or exclusions:

• Scenario: Automated Backup and Maintenance Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik) or maintenance scripts often utilize compiled .NET executables that share naming conventions with security tools. For instance, a scheduled job running Veeam.Backup.Service.exe might be flagged because the rule matches generic ”.NET” tool names associated with red-team operations.
  • Filter/Exclusion: Exclude processes where the ImageFileName contains specific vendor prefixes (e.g., *Veeam*, *Rubrik*) AND the CommandLine includes known backup parameters like /backup or /maintenance.

• Scenario: CI/CD Pipeline Build Agents

  • Context: In DevOps environments, build agents (such as Jenkins, Azure DevOps, or GitHub Actions runners) frequently execute .NET-based compilation tools. A legitimate build process running dotnet.exe, MSBuild.exe, or a custom tool named RedTeam.Scanner.dll on a build server can trigger the rule if the agent is not explicitly whitelisted.
  • Filter/Exclusion: Create an exclusion for hosts belonging to the “DevOps” or “CI-CD” OU (Organizational Unit) where the parent process is Jenkins.exe, vstest.console.exe, or taskagent.exe.

• Scenario: Endpoint Detection and Response (EDR) Self-Protection

  • Context: The EDR agent itself often includes .NET components for policy management, threat intelligence updates, or internal scanning. For example, a tool named SentinelOne.RedTeamAgent.exe running on the same endpoint might be detected by this rule as an external