Detects .NET red/black-team tools via name

Hunt Hypothesis

This detection identifies the execution of known .NET-based Red and Black team reconnaissance or attack tools by matching process names against a curated list of security utilities. Proactively hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate security operations from adversarial activity that mimics standard tooling to evade signature-based defenses.

YARA Rule

rule HKTL_NET_NAME_ibombshell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Telefonica/ibombshell"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "ibombshell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters or exclusions:

Scenario: Automated Backup Jobs Using PowerShell
- Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize .NET based agents or custom PowerShell scripts that invoke dotnet.exe to manage data snapshots. These processes frequently spawn child processes with names resembling security tools (e.g., Veeam.Backup.Agent.exe) which may contain keywords like “Red” or “Blue” in their version strings or command lines, triggering the rule.
- Filter/Exclusion: Exclude process names containing specific vendor prefixes (e.g., Veeam.*, Commvault.*) running under the context of known service accounts (e.g., DOMAIN\BackupSvc).
Scenario: Scheduled Compliance Scanning via .NET CLI
- Context: Internal compliance teams run nightly scans using custom .NET Command Line Interface (CLI) tools to audit Active Directory or file permissions. These scripts often name their executables generically, such as ComplianceScan.Red.exe, which matches the rule’s logic for “Red-team” tool naming conventions despite being a legitimate administrative task.
- Filter/Exclusion: Create an exclusion based on the parent process (e.g., Task Scheduler or System) and restrict detection to specific file paths where these custom tools are installed (e.g., C:\Program Files\InternalTools\Compliance\).
Scenario: CI/CD Pipeline Execution in Build Agents
- Context: DevOps build agents (such as Azure DevOps or Jenkins) execute .NET applications during the continuous integration phase. These agents often run tools named BuildAgent.RedTool.exe to simulate security testing within the pipeline,