Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known Red and Black team .NET utilities by matching process names against a curated list of security testing tools. Proactively hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate security assessments from adversarial activity that may mimic similar tooling to evade detection or conduct reconnaissance.

YARA Rule

rule HKTL_NET_NAME_FudgeC2 {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Ziconius/FudgeC2"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "FudgeC2" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/Ziconius/FudgeC2
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters and exclusions:

• Scenario: Automated Vulnerability Scanning

  • Context: Security teams often deploy automated scanners like Tenable Nessus, Qualys, or Rapid7 InsightVM which utilize .NET-based agents to perform asset discovery and vulnerability assessments on endpoints. These tools frequently execute processes with names matching known red-team tooling (e.g., NessusAgent.exe or custom wrappers) that trigger the rule.
  • Filter/Exclusion: Create an exclusion based on the Process Image Path and Parent Process. Exclude any process where the image path contains \Program Files\Tenable\ or \Qualys\, provided the parent process is a known service host (e.g., svchost.exe) or the specific scanner daemon.

• Scenario: Enterprise Backup and Recovery Jobs

  • Context: Scheduled backup solutions such as Veeam Explorer for Microsoft 365, Acronis Cyber Protect, or Rubrik often run .NET-based agents to index data, perform snapshots, or manage replication. These agents may have executable names (e.g., VeeamAgent.exe, AcronisService.exe) that overlap with the naming convention of red-team reconnaissance tools.
  • Filter/Exclusion: Implement a filter based on Scheduled Task Name and User Context. Exclude events where the process is launched by the SYSTEM account via a scheduled task containing keywords like “Backup”, “Snapshot”, or “Replication” in the task name, specifically targeting known backup vendors.

• Scenario: Endpoint Detection and Response (EDR) Telemetry

  • Context: Modern EDR platforms like CrowdStrike Falcon, **