Detects .NET red/black-team tools via name

Hunt Hypothesis

This hunt hypothesis identifies the execution of known .NET-based red and blue team utility names to distinguish legitimate security operations from potential adversary tooling that mimics these signatures. Proactively hunting for this activity in Azure Sentinel allows the SOC team to validate authorized testing efforts while rapidly isolating suspicious instances where attackers leverage similar tools to evade detection during reconnaissance or post-exploitation phases.

YARA Rule

rule HKTL_NET_NAME_RdpThief {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/0x09AL/RdpThief"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "RdpThief" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/0x09AL/RdpThief
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters or exclusions:

• Scheduled Backup Jobs Using PowerShell

  • Scenario: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize PowerShell scripts compiled as .NET executables to manage data snapshots. These scripts frequently invoke standard .NET assemblies that match the naming patterns of security tools like PowerShell.exe or custom .dll names used by red/blue team frameworks.
  • Filter/Exclusion: Exclude processes running under specific service accounts (e.g., DOMAIN\BackupSvc) and filter paths restricted to known backup installation directories (e.g., C:\Program Files\Veeam\...).

• CI/CD Pipeline Build Agents

  • Scenario: DevOps build servers (such as Azure DevOps or Jenkins agents) execute .NET-based compilation tasks. During builds, these agents spawn temporary .NET processes to run unit tests or deploy artifacts, which may mimic the file names of security assessment tools like Pester.exe or NUnit3TestAdapter.dll.
  • Filter/Exclusion: Create an exclusion for process paths located within build agent workspaces (e.g., C:\BuildAgents\...) and exclude executions originating from known CI/CD service accounts.

• Endpoint Management & Patching Tools

  • Scenario: IT management suites like Microsoft Endpoint Configuration Manager (SCCM) or Intune utilize .NET agents to push updates and inventory hardware. These agents often launch diagnostic utilities with names similar to red-team tools (e.g., InventoryAgent.exe or UpdateManager.dll) that trigger the rule during scheduled maintenance windows.
  • Filter/Exclusion: Exclude processes where the parent process is a known management agent (e.g., `ccmexec