Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule detects the execution of known .NET-based red and black team tools by matching process names against a curated list of security testing utilities. Proactive hunting for these artifacts in Azure Sentinel enables the SOC to distinguish legitimate security assessments from potential adversary activity that mimics similar tooling patterns, thereby reducing false positives during incident response.

YARA Rule

rule HKTL_NET_NAME_gray_hat_csharp_code {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/brandonprry/gray_hat_csharp_code"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "gray_hat_csharp_code" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters or exclusions:

Scenario: Legitimate automated backup scripts utilizing Microsoft Power Automate or Azure Logic Apps (often running as background services) executing .exe files with names containing keywords like PowerShell, Automation, or Orchestrator.
- Suggested Filter/Exclusion: Create an exclusion based on the specific process image path (e.g., C:\Program Files\Microsoft Power Automate\...) and exclude processes where the parent process is a known service host (svchost.exe with specific service names) or the scheduled task name contains “Backup” or “Sync”.
Scenario: Enterprise-wide deployment of security agents such as CrowdStrike Falcon or SentinelOne, which utilize .NET-based components for policy updates and telemetry collection, often spawning processes named FalconService.exe or S1Agent.exe.
- Suggested Filter/Exclusion: Exclude known vendor binaries by adding their specific SHA-256 hashes to a whitelist. Alternatively, filter out any process where the publisher is “CrowdStrike” or “SentinelOne” and the command line arguments contain standard update flags (e.g., /update, /telemetry).
Scenario: Scheduled administrative jobs running Microsoft SQL Server Reporting Services or Dynamics 365 plugins that execute .NET assemblies for data aggregation, often appearing as w3wp.exe or custom named executables like ReportServerService.
- Suggested Filter/Exclusion: Implement a time-based exclusion window (e.g., exclude alerts between 02:00 and 06:00 local time) for processes running on specific server roles labeled “Reporting” or “ERP”.