Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based offensive and defensive utilities by matching process names against a curated list of Red Team and Blue Team tooling signatures. Proactive hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate security operations from adversarial activity that leverages similar frameworks to establish persistence or conduct reconnaissance within the environment.

YARA Rule

rule HKTL_NET_NAME_MaliciousClickOnceGenerator {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "MaliciousClickOnceGenerator" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters or exclusions:

Scenario: Automated Backup and Maintenance Scripts
- Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize embedded .NET agents to perform nightly snapshot tasks. These agents frequently execute binaries named Veeam.Backup.Service.exe or Commvault.Agent.exe, which contain “Service” or “Agent” in their names, mimicking the naming convention of security tools.
- Suggested Filter: Exclude processes where the command line contains specific backup keywords (e.g., --backup-mode, --snapshot) AND the parent process is a known service host like svchost.exe or vssvc.exe.
Scenario: Internal DevOps Build Agents
- Context: In a CI/CD environment, build servers (like Jenkins, TeamCity, or Azure DevOps) run .NET-based build agents on endpoint machines. These agents often launch tools named MSBuild.exe, NuGet.CommandLine.exe, or custom wrappers like DevOps.BuildAgent.dll to compile code and manage dependencies during the workday.
- Suggested Filter: Create an exclusion for processes running under user accounts with “Service” or “Build” in their name (e.g., DOMAIN\CI-Build-User) and restrict detection to execution paths located within designated build directories (e.g., C:\Program Files\Jenkins\agents\).
Scenario: Endpoint Detection and Response (EDR) Self-Protection
- Context: The organization’s primary EDR solution (e.g., CrowdStrike Falcon, Carbon Black, or SentinelOne) utilizes .NET components for its own telemetry collection and policy enforcement. These internal tools often have names