Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based red and black team reconnaissance tools by matching process names against a curated list of security utilities. Proactively hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate security testing activities from potential adversary use of similar frameworks for stealthy command-and-control or lateral movement operations.

YARA Rule

rule HKTL_NET_NAME_PandaSniper {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/QAX-A-Team/PandaSniper"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "PandaSniper" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Scenario: A DevOps engineer executes Pester (a PowerShell testing framework) or Invoke-Build on a build server to run automated unit tests. These .NET-based tools often spawn processes with names like pester.exe, build.ps1, or generic dotnet.exe wrappers that match the rule’s signature for Red/Black team reconnaissance tools.
- Suggested Filter: Create an exclusion based on the specific process image path (e.g., C:\BuildAgent\Tools\Pester\bin\pester.exe) and restrict the alert to only trigger when the parent process is not a known CI/CD service like jenkins-agent.exe or teamcity-build-runner.exe.
Scenario: The IT Operations team runs a scheduled nightly job using Microsoft Defender for Endpoint (formerly WVD) or SCCM (Configuration Manager) to perform asset inventory and vulnerability scanning. These .NET applications often utilize internal tools named InventoryScanner.exe or VulnAssessment.dll which mimic the naming convention of security assessment tools like Nessus or Qualys agents.
- Suggested Filter: Implement a filter that excludes processes running under specific service accounts (e.g., NT SERVICE\SCCMService or DOMAIN\svc-inventory) and restricts alerts to business hours if the tool is known to run outside of standard maintenance windows.
Scenario: A security analyst manually launches Sysmon configuration tools or BloodHound (a .NET-based Active Directory attack path analyzer) on a dedicated jump host to perform an ad-hoc audit. The process name bloodhound.exe or sysmonconfig.exe directly triggers the rule as it is designed to detect Red Team enumeration tools.
- Suggested Filter: Add an exclusion for processes launched from specific administrative workstations (identified by hostname pattern, e