Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based red and blue team utility processes by matching their specific file names against a curated list of common security testing tools. Proactively hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate internal security exercises from potential adversary activity that mimics standard tooling to evade detection.

YARA Rule

rule HKTL_NET_NAME_SharpOffensiveShell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/darkr4y/SharpOffensiveShell"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "SharpOffensiveShell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/darkr4y/SharpOffensiveShell
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters and exclusions:

• Scenario: Automated Backup Jobs Using PowerShell Modules

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize .NET-based PowerShell modules or custom scripts to manage data replication. These processes frequently spawn executables with names resembling security tools (e.g., Veeam.Backup.Service.exe or Commvault.NetAgent.dll) which may match the rule’s keyword list for “red/blue team” tools.
  • Suggested Filter/Exclusion: Create an exclusion based on Process Command Line containing specific backup keywords (e.g., backup, replication, snapshot) OR exclude processes running under known service accounts like VeeamBackupService or CommvaultAgent.

• Scenario: Endpoint Detection and Response (EDR) Self-Scanning

  • Context: The organization’s primary EDR agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) includes internal .NET components that perform self-health checks or threat intelligence updates. These components often have generic names like FalconSensorHelper.exe or DefenderUpdateService.exe, which can be misidentified as external red-team simulation tools.
  • Suggested Filter/Exclusion: Exclude processes where the Publisher is the EDR vendor (e.g., “CrowdStrike, Inc.” or “Microsoft Corporation”) and the process path resides within the standard installation directory (e.g., C:\Program Files\CrowdStrike\), rather than temporary folders like %TEMP%.

• Scenario: Scheduled CI/CD Pipeline Execution

  • Context: DevOps pipelines running on build servers often execute .NET-based deployment agents or testing frameworks (e.g.,