Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based offensive and defensive utilities by matching process names against a curated list of Red Team and Blue Team tooling signatures. Proactively hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate security operations from adversarial activity that mimics standard administrative tools to evade detection.

YARA Rule

rule HKTL_NET_NAME_NativePayload_Reverse_tcp {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "NativePayload_Reverse_tcp" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp
• Source Rule

False Positive Guidance

• Scheduled Backup or Reporting Tasks: Enterprise environments often utilize custom .NET applications for nightly reporting or data archiving that mimic the naming conventions of security tools. For instance, a scheduled task named ReportGenerator.exe or DataArchiver.exe running under the context of a dedicated service account (e.g., svc-reporting) might trigger this rule if the tool’s executable name overlaps with known red-team utility names like SharpHound or Bloodhound.

  • Filter/Exclusion: Add an exclusion for processes where the command line contains specific keywords related to reporting (e.g., --mode=archive, --report) and restrict the rule to exclude execution under service accounts that are not interactive logons, specifically targeting known service account names like svc-reporting or svc-backup.

• Software Deployment and Patching Agents: IT operations frequently deploy .NET-based patching agents (such as SCCM clients or custom update scripts) that execute tools with generic or security-oriented naming conventions. A legitimate deployment job running a tool named PatchManager.exe or UpdateAgent.exe could be flagged if these names resemble black-team utilities like PowerSploit modules or SharpUp.

  • Filter/Exclusion: Create an exclusion based on the parent process being a known enterprise management agent (e.g., ccmexec.exe for SCCM or wsappx.exe) and limit the detection to exclude processes running within specific deployment folders (e.g., C:\Program Files\Microsoft Configuration Manager).

• Internal Development and QA Environments: In organizations with internal R&D teams, developers often run .NET-based testing frameworks or CI/CD pipelines that utilize tools like TestRunner.exe or BuildValidator.exe. These tools may execute .NET assemblies that share naming patterns with red-team tools (e.g., SharpView, NetExec) during automated build cycles.