Detects .NET red/black-team tools via name

Hunt Hypothesis

This hunt hypothesis identifies the execution of known .NET-based red and blue team utility names to distinguish legitimate security testing from potential adversary tooling used for reconnaissance or lateral movement. Proactively hunting for these artifacts in Azure Sentinel is essential because attackers frequently leverage standard .NET tools to blend their malicious activities with routine administrative operations, thereby evading signature-based detection.

YARA Rule

rule HKTL_NET_NAME_HexyRunner {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/bao7uo/HexyRunner"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "HexyRunner" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/bao7uo/HexyRunner
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters or exclusions:

• Scenario: A scheduled backup job utilizes Veeam Backup & Replication (which relies heavily on .NET assemblies) to perform nightly database snapshots. The detection logic flags the Veeam.Backup.Service.exe process as a potential red-team tool because its name contains common keywords often found in security utilities.

  • Suggested Filter: Exclude processes where the ImageName matches *Veeam*.exe AND the CommandLine contains specific backup parameters (e.g., --mode=backup), or whitelist the specific file hash of the Veeam service executable on known backup servers.

• Scenario: The IT Operations team deploys a custom internal application named AssetTracker.NET using Microsoft Endpoint Configuration Manager (SCCM). This tool runs as a background service to inventory hardware and software, triggering the rule due to the ”.NET” suffix in its process name which mimics security tool naming conventions.

  • Suggested Filter: Create an exclusion for processes running under the AssetTracker.NET image path located within the trusted directory C:\Program Files\Internal Tools\. Additionally, filter out events where the ParentProcessName is ccmexec.exe (the SCCM client agent).

• Scenario: A DevOps pipeline executes a continuous integration build using Jenkins with a .NET plugin. The Jenkins worker node spawns a process named jenkins-build-agent.exe which invokes .NET reflection libraries, causing the rule to flag it as a potential black-team reconnaissance tool due to the “agent” and ”.NET” naming pattern.

  • Suggested Filter: Exclude events where the SourceComputerName belongs to the specific subnet or host group designated for CI/CD build