Detects .NET red/black-team tools via name

Hunt Hypothesis

This detection identifies the execution of known .NET-based offensive and defensive utilities by monitoring process names associated with Red Team and Black Team tooling. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to distinguish legitimate security operations from potential adversary activity that mimics standard .NET tools to evade discovery.

YARA Rule

rule HKTL_NET_NAME_MSBuildAPICaller {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/rvrsh3ll/MSBuildAPICaller"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "MSBuildAPICaller" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/rvrsh3ll/MSBuildAPICaller
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters and exclusions:

• Scenario: Automated Backup Service Execution

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik) often utilize .NET-based agents running under service accounts to manage data snapshots. These agents may execute binaries named Veeam.Backup.Service.exe or similar .NET wrappers that match the rule’s naming pattern for security tools.
  • Filter/Exclusion: Exclude processes where the CommandLine contains keywords like “backup”, “snapshot”, or “sync” and the UserAccount is a dedicated service account (e.g., DOMAIN\svc_backup).

• Scenario: Scheduled Patch Deployment Jobs

  • Context: IT Operations teams frequently use .NET-based deployment tools (such as SCCM client agents, Ansible Tower runners, or custom PowerShell wrappers) to push patches during maintenance windows. These jobs often run under the SYSTEM account and invoke executables like PatchDeployAgent.exe.
  • Filter/Exclusion: Create an exclusion for processes running between 02:00 and 06:00 UTC on weekdays where the ParentProcessName is TaskScheduler.exe or ccmexec.exe.

• Scenario: Internal Compliance & Audit Scanners

  • Context: Security teams deploy internal compliance scanners (e.g., custom .NET applications built to check file permissions or registry states) that mimic the behavior of external red-team tools. These might be named ComplianceAuditRunner.dll or InternalSecurityCheck.exe.
  • Filter/Exclusion: Filter out events where the ProcessName matches a known list of internal audit tool names (e.g., ^Internal.*\.exe$) and the