Detects .NET red/black-team tools via name

Hunt Hypothesis

This detection identifies adversary activity involving known .NET-based Red and Blue Team tools by matching process names against a curated YARA signature, which helps distinguish legitimate security operations from potential malicious tool usage. Proactively hunting for this behavior in Azure Sentinel is essential to reduce false positives during threat investigations and ensure that the presence of these specific utilities does not obscure genuine attack signals within the environment.

YARA Rule

rule HKTL_NET_NAME_GhostLoader {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/TheWover/GhostLoader"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "GhostLoader" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/TheWover/GhostLoader
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the HKTL_NET_NAME_GhostLoader detection rule, including suggested filters and exclusions:

• Scenario: Automated Deployment via Octopus Deploy or Jenkins

  • Context: In enterprise CI/CD pipelines, deployment agents (often running as .NET services) frequently spawn processes named GhostLoader.exe or similar variants to inject configuration updates into target machines. These tools mimic the behavior of red-team loaders by reading from network shares and executing payloads.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Image Path and Parent Process. Exclude alerts where the parent process is Octopus.Service.exe, Jenkins.Agent.exe, or TfsBuildAgent.exe located in known deployment directories (e.g., C:\Program Files\Octopus Deploy\...).

• Scenario: Scheduled Microsoft System Center Configuration Manager (SCCM) Tasks

  • Context: SCCM often utilizes custom .NET extensions for software distribution and compliance checking. During scheduled maintenance windows, the GhostLoader component may be invoked to stage applications or update client agents, triggering the rule due to its .NET nature and specific naming convention.
  • Suggested Filter/Exclusion: Implement a filter based on Process Command Line arguments containing specific SCCM identifiers (e.g., /taskID, /siteCode) and restrict the scope to machines within the SCCM-Management Active Directory security group or OU.

• Scenario: Legitimate Endpoint Protection Scanning (CrowdStrike/SentinelOne)

  • Context: Modern EDR solutions frequently employ .NET-based heuristic scanners that utilize a process named GhostLoader to perform on-access scanning of .NET assemblies in real-time. This is particularly common when the EDR engine updates its definition database or scans a large directory of compiled