Detects .NET red/black-team tools via name

Hunt Hypothesis

This detection identifies the execution of known .NET-based Red and Blue team utility names to distinguish legitimate security operations from potential adversary tool usage within the environment. Proactive hunting for these artifacts in Azure Sentinel is essential to validate authorized testing activities and quickly uncover unauthorized or stealthy .NET tools that adversaries may deploy to establish persistence or conduct reconnaissance.

YARA Rule

rule HKTL_NET_NAME_reconness {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/reconness/reconness"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "reconness" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/reconness/reconness
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the rule “Detects .NET red/black-team tools via name,” along with suggested filters or exclusions:

• Scenario: Automated Backup and Reporting Scripts

  • Context: Enterprise IT teams often deploy internal .NET applications (e.g., BackupAgent.exe, ReportGenerator.dll) that utilize common naming conventions similar to security tools. These scripts run on scheduled tasks during off-hours, executing in the same directories as security agents.
  • Filter/Exclusion: Create a filter to exclude processes where the Image Path contains specific enterprise backup directories (e.g., C:\Program Files\EnterpriseBackup\) and the Command Line includes known internal script names like InternalReport.exe or DataSyncService.exe.

• Scenario: Software Deployment via Microsoft Endpoint Configuration Manager (SCCM/Intune)

  • Context: During mass software deployments, SCCM or Intune agents launch .NET-based deployment tools (e.g., App-VirtualizationAgent.exe, DeployTool_v2.0.exe) that mimic the naming patterns of red-team emulation tools used for penetration testing. These often run on endpoints with high privilege.
  • Filter/Exclusion: Exclude events where the Parent Process Name is ccmexec.exe (SCCM) or Microsoft.IntuneManagementAgent.exe, as these are trusted orchestrators launching legitimate deployment payloads rather than suspicious red-team activity.

• Scenario: Internal Development and CI/CD Pipeline Agents

  • Context: In hybrid environments where developers have access to production servers, internal Continuous Integration (CI) agents (e.g., JenkinsAgent.dll, AzureDevOpsRunner.exe) execute .NET build tasks. These tools often carry names resembling black-team analysis utilities and run under service accounts with broad permissions.