Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based red and blue team utility names to distinguish legitimate security operations from potential adversary tooling that mimics these signatures. Proactive hunting for this behavior in Azure Sentinel is essential to validate authorized activities and uncover stealthy threats leveraging familiar .NET tools to evade standard detection mechanisms.

YARA Rule

rule HKTL_NET_NAME_MagentoScanner {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/soufianetahiri/MagentoScanner"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "MagentoScanner" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/soufianetahiri/MagentoScanner
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters or exclusions:

• Scenario: Automated Backup and Maintenance Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize .NET-based agents that execute scripts named Veeam.Backup.Engine.exe or Commvault.CommandCenter.exe. These tools mimic the naming convention of security utilities by including terms like “Engine,” “Agent,” or “Service” in their filenames.
  • Suggested Filter: Exclude processes where the Image Path contains specific backup vendor directories (e.g., C:\Program Files\Veeam\Backup and Replication\) AND the Parent Process Name is a known service host like svchost.exe or wuauserv.exe.

• Scenario: Internal DevOps CI/CD Pipeline Agents

  • Context: Build servers (such as Jenkins, TeamCity, or Azure DevOps) frequently run .NET-based build agents on developer workstations. These agents often execute tools named BuildAgent.exe, AzurePipelines.Agent.Service.exe, or NuGet.CommandLine.exe to compile code and manage dependencies, which triggers the rule due to their .NET nature and tool-like naming.
  • Suggested Filter: Create an exclusion for processes running under specific service accounts (e.g., NT SERVICE\JenkinsBuildAgent) where the Command Line arguments contain keywords like “build,” “compile,” or “pipeline” rather than security-related flags.

• Scenario: Scheduled Endpoint Configuration Management

  • Context: IT operations teams use tools like Microsoft SCCM (Configuration Manager) or Ansible to push configuration updates. These systems often launch .NET executables named ccmexec.exe, `AppDeploymentService