Detects .NET red/black-team tools via name

Hunt Hypothesis

This detection identifies the execution of known .NET-based Red and Black team tools by analyzing process names to distinguish between legitimate security operations and potential adversary reconnaissance or post-exploitation activities. Proactively hunting for these signals in Azure Sentinel enables the SOC to rapidly validate authorized tool usage while uncovering unauthorized instances that may indicate an adversary leveraging familiar security frameworks to mask malicious behavior.

YARA Rule

rule HKTL_NET_NAME_SharpCat {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Cn33liz/SharpCat"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "SharpCat" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/Cn33liz/SharpCat
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters or exclusions:

• Scenario: Scheduled Backup Jobs Utilizing PowerShell Modules

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often execute scheduled tasks that load specific .NET assemblies or invoke PowerShell scripts named similarly to security tools (e.g., Veeam.Backup.PowerShell.dll or scripts invoking System.Management.Automation). These legitimate jobs may spawn processes with names matching the rule’s signature for “red-team” reconnaissance tools.
  • Suggested Filter: Create an exclusion based on the Parent Process Name and Scheduled Task ID. Exclude alerts where the parent process is Veeam.Backup.Service.exe or commvault.cmd AND the command line contains a specific scheduled task GUID associated with backup routines.

• Scenario: Deployment of Internal .NET Applications via CI/CD Pipelines

  • Context: During deployment windows, internal DevOps tools (e.g., Octopus Deploy, Jenkins agents) or custom in-house management consoles execute .NET applications to update configurations. These tools often use generic naming conventions like DeploymentAgent.exe or ConfigManager.dll, which can be misidentified as active red-team enumeration tools scanning the network.
  • Suggested Filter: Implement a filter based on User Context and Process Path. Exclude events where the user account is a dedicated service account (e.g., svc-deploy-agent) AND the process path resides within a known deployment directory (e.g., C:\Program Files\Octopus Deploy\Worker\).

• Scenario: Execution of Standard Administrative PowerShell Scripts

  • Context: System administrators frequently run custom .NET-based PowerShell scripts for routine maintenance, such as patching or user provisioning. If these scripts