Detects .NET red/black-team tools via name

Hunt Hypothesis

This detection rule identifies the execution of known .NET-based Red and Blue team utility names to distinguish legitimate security operations from potential adversary tooling that mimics these signatures. Proactive hunting for this behavior in Azure Sentinel is essential to validate authorized internal activities and uncover stealthy adversaries leveraging familiar .NET tools to evade standard signature-based defenses.

YARA Rule

rule HKTL_NET_NAME_RunasCs {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/antonioCoco/RunasCs"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "RunasCs" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/antonioCoco/RunasCs
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters and exclusions:

• Scenario: Legitimate automated backup jobs utilizing Veeam Backup & Replication or Commvault. These enterprise-grade solutions often spawn .NET processes (e.g., Veeam.Backup.Service.exe, commvault.cmd) that match the naming patterns of red-team tools like Cobalt Strike’s Beacon or custom C# implants.

  • Suggested Filter/Exclusion: Create an exclusion based on the specific executable path and hash. Add a filter to ignore events where the file path starts with C:\Program Files\Veeam\ or C:\CommServe\, ensuring only known backup infrastructure triggers are bypassed.

• Scenario: Scheduled maintenance tasks running Microsoft System Center Configuration Manager (SCCM) or Intune Management Extension. These tools frequently execute .NET agents to deploy patches and inventory hardware, often naming processes generically (e.g., ccmexec.exe, TaskSchedulerAgent.exe) which can overlap with the detection logic for black-team reconnaissance tools.

  • Suggested Filter/Exclusion: Implement a time-based exclusion window for known maintenance windows (e.g., 02:00–04:00 UTC) combined with an allow-list of parent processes. If the parent process is identified as ccmexec.exe or msiexec.exe, suppress alerts generated by child .NET tools during these hours.

• Scenario: Internal DevOps pipelines executing .NET Core build agents (e.g., Jenkins, Azure DevOps Agents) on build servers. These agents often run custom C# scripts for code analysis and dependency scanning that mimic the behavior of red-team tooling suites like SharpChisel or PowerSploit.

  • **Suggested Filter/Exclusion