Detects .NET red/black-team tools via name

Hunt Hypothesis

This hunt hypothesis identifies the execution of known .NET-based red and black team utilities by monitoring process names that match established tool signatures within the Azure Sentinel environment. Proactively hunting for these artifacts allows the SOC team to distinguish between legitimate security testing activities and potential adversary use of similar tools for reconnaissance or lateral movement, ensuring no malicious activity is overlooked amidst routine operations.

YARA Rule

rule HKTL_NET_NAME_NativePayload_ReverseShell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/NativePayload_ReverseShell"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "NativePayload_ReverseShell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/DamonMohammadbagher/NativePayload_ReverseShell
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters and exclusions:

• Scheduled Backup Jobs Using PowerShell Scripts

  • Scenario: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize custom .NET PowerShell scripts to manage agent communication or process logs. These scripts may invoke executables with names resembling security tools (e.g., BackupAgent.exe, LogProcessor.exe) running under the context of a dedicated service account like DOMAIN\svc_backup.
  • Filter/Exclusion: Exclude processes where the parent image is a known backup engine (e.g., Veeam.Backup.Service.exe) and the user context matches the specific backup service account.

• Microsoft Endpoint Configuration Manager (SCCM) Client Updates

  • Scenario: The SCCM client (ccmexec.exe) frequently launches .NET-based deployment agents to install software updates or run compliance checks on endpoints. These agents often have generic names like AppDeploymentAgent.exe or ComplianceChecker.dll, which can trigger the rule when they execute during maintenance windows.
  • Filter/Exclusion: Create an exclusion for processes spawned by ccmexec.exe (PID 1024-9999 range) where the command line contains keywords like “SoftwareUpdate” or “Compliance,” specifically during defined maintenance hours (e.g., 02:00–06:00 UTC).

• Internal DevOps CI/CD Pipeline Agents

  • Scenario: In environments with on-premise build servers, agents (such as Jenkins nodes or Azure DevOps agents) run .NET tools to compile code and execute unit tests. Tools like dotnet.exe, TestRunner.exe, or custom internal utilities named BuildValidator are common in these