Detects .NET red/black-team tools via name

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging known .NET-based Red and Black team tools to establish a foothold or conduct internal reconnaissance within the environment. A proactive hunt is essential in Azure Sentinel to identify these specific tool executions early, distinguishing legitimate security operations from potential adversary activity that mimics standard administrative behavior.

YARA Rule

rule HKTL_NET_NAME_RemoteProcessInjection {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Mr-Un1k0d3r/RemoteProcessInjection"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "RemoteProcessInjection" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters or exclusions:

Scenario: Automated Backup and Maintenance Scripts
- Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize internal .NET agents that execute scheduled jobs during off-hours. These agents frequently spawn processes named Veeam.Backup.Service.exe or similar .NET wrappers that match the naming convention of security tools.
- Suggested Filter: Exclude process names containing specific vendor prefixes (e.g., ^Veeam\., ^Commvault\.) and restrict detection to non-maintenance windows (e.g., exclude alerts between 02:00–06:00 local time).
Scenario: Endpoint Detection and Response (EDR) Self-Defense
- Context: The organization’s primary EDR agent (such as CrowdStrike Falcon or Microsoft Defender for Endpoint) runs its own .NET-based management services. When the EDR performs a self-scan, updates its signature database, or communicates with the cloud console, it may launch child processes that mimic red-team tool names.
- Suggested Filter: Create an exclusion based on the parent process name (e.g., ParentProcessName IN ('FalconSensor.exe', 'MsMpEng.exe')) to prevent the EDR from triggering alerts against its own components.
Scenario: Internal DevOps and CI/CD Pipeline Execution
- Context: Build servers (like Jenkins, TeamCity, or Azure Dev Agents) running on build nodes often execute .NET-based compilation tasks or deployment agents. These tools frequently use generic names like BuildAgent.exe or DotNetCore.Tasks.dll which can be misidentified as active red-team reconnaissance tools during a sprint cycle.