This detection identifies the execution of known .NET-based Red and Blue team utility names to distinguish legitimate security operations from potential adversary tooling that mimics these signatures. A proactive hunt is essential in Azure Sentinel to validate these processes against expected baselines, ensuring that attackers leveraging familiar .NET tools for lateral movement or persistence are not overlooked due to their benign appearance.
rule HKTL_NET_NAME_RevengeRAT_Stub_CSsharp {
meta:
description = "Detects .NET red/black-team tools via name"
reference = "https://github.com/NYAN-x-CAT/RevengeRAT-Stub-CSsharp"
author = "Arnim Rupp"
date = "2021-01-22"
strings:
$name = "RevengeRAT-Stub-CSsharp" ascii wide
$compile = "AssemblyTitle" ascii wide
condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters or exclusions:
Scenario: Legitimate automated deployment pipelines executing standard CI/CD agents (e.g., Octopus Deploy, TeamCity, or Azure DevOps Agents) which run as .NET processes named Octo.exe, JetBrains.TeamCity.Agent.exe, or VstsTaskAgent.exe on build servers.
^(Octo|JetBrains\.TeamCity\.Agent|VstsTaskAgent)\.exe$ where the parent process is a known service host (e.g., svchost.exe) or the user context is a dedicated build account (e.g., DOMAIN\BuildService).Scenario: Scheduled maintenance jobs running .NET-based backup and monitoring utilities, such as Veeam Backup & Replication (Veeam.Backup.Service.exe) or SolarWinds Orion (OrionProcessHost.exe), which are frequently misidentified as security tools due to their .NET framework usage.
Veeam.Backup.Service.exe, OrionProcessHost.exe, Zabbix.Agent.exe) running under the context of local system accounts (NT AUTHORITY\SYSTEM) or dedicated service accounts.Scenario: Internal IT administration tasks utilizing custom .NET scripts for user provisioning or asset management, such as a legacy tool named AssetManagerTool.exe or UserProvisioningService.exe, which are launched manually by helpdesk staff via the Start Menu or RDP sessions.