Detects .NET red/black-team tools via name

Hunt Hypothesis

This detection rule identifies the execution of known .NET-based Red and Black team tools by analyzing process names to distinguish legitimate security testing from potential adversary activity. Proactively hunting for these indicators in Azure Sentinel is essential to differentiate between authorized penetration tests and malicious reconnaissance or lateral movement attempts that mimic similar tooling patterns.

YARA Rule

rule HKTL_NET_NAME_petaqc2 {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/fozavci/petaqc2"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "petaqc2" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/fozavci/petaqc2
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with recommended filters or exclusions:

• Scenario: Scheduled Backup and Maintenance Jobs

  • Context: Enterprise backup solutions like Veeam, Rubrik, or internal maintenance scripts often utilize .NET executables (e.g., Veeam.Backup.Service.exe, Rubrik.Agent.exe) that run on a strict schedule. These tools may contain naming patterns similar to security utilities, triggering the rule during routine data protection windows.
  • Filter/Exclusion: Exclude processes where the ImageName matches known backup service executables and the ParentProcessName is svchost.exe or TaskScheduler.exe, specifically during defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Endpoint Management and Patching Agents

  • Context: Tools such as Microsoft System Center Configuration Manager (SCCM), Ivanti Neurons, or Jamf Pro agents frequently execute .NET-based components to deploy patches, inventory hardware, or run compliance checks. These agents often spawn child processes with names resembling red-team tools (e.g., ConfigMgrSMS.exe, Ivanti.Agent.DotNet.dll).
  • Filter/Exclusion: Create an exclusion for process paths located within standard management agent directories (e.g., C:\Program Files\Microsoft Configuration Manager\ or C:\ProgramData\Ivanti\) where the CommandLine contains keywords like “inventory,” “patching,” or “compliance.”

• Scenario: Internal .NET Development and Build Pipelines

  • Context: In organizations with internal DevOps teams, CI/CD pipelines (e.g., Azure DevOps, Jenkins)