Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based red and blue team utilities by matching process names against a curated list of security tooling signatures. Proactively hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate internal testing activities from potential adversaries leveraging similar frameworks to establish persistence or conduct reconnaissance within the environment.

YARA Rule

rule HKTL_NET_NAME_Recon_AD {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/outflanknl/Recon-AD"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "Recon-AD" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/outflanknl/Recon-AD
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the rule “Detects .NET red/black-team tools via name”, including suggested filters and exclusions:

• Scenario: Automated Security Scanning by Enterprise Antivirus

  • Context: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender) regularly launches internal .NET scanning modules to perform real-time threat assessment or scheduled vulnerability scans. These tools often utilize executable names like falcon.sysmon.exe or defender.msc.exe which contain keywords matching the rule’s detection logic for security tools.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Image Path and Parent Process Name. Exclude any .NET process where the parent is the known antivirus service (e.g., C:\Program Files\CrowdStrike\...\falcon.sysmon.exe) or where the image path resides within the vendor’s installation directory.

• Scenario: Scheduled Compliance Reporting Job

  • Context: A nightly scheduled task runs a custom .NET application named ComplianceAuditTool.exe to aggregate logs and generate reports for regulatory compliance (e.g., SOC2, HIPAA). This tool is developed in-house using the .NET framework and mimics the naming convention of standard red-team tools like Invoke-Command.ps1 or similar utility names.
  • Suggested Filter/Exclusion: Implement a filter based on Scheduled Task Name or User Context. Exclude events where the process is launched by the “System” account via a specific Scheduled Task ID (e.g., \Microsoft\Windows\ScheduledTasks\ComplianceReport) and runs during off-hours (e.g., 02:00 – 04:00).

• Scenario: Deployment of Internal .NET Management Utilities

  • Context: The IT Operations team