Detects .NET red/black-team tools via name

Hunt Hypothesis

This hunt hypothesis identifies the execution of known .NET-based red and blue team utilities by monitoring process names that match established tool signatures within the Azure Sentinel environment. Proactively hunting for these specific artifacts allows the SOC team to distinguish between legitimate security testing activities and potential adversary reconnaissance, ensuring that authorized tools are not mistaken for malicious behavior while maintaining visibility into internal security operations.

YARA Rule

rule HKTL_NET_NAME_SharPyShell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/antonioCoco/SharPyShell"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "SharPyShell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/antonioCoco/SharPyShell
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters and exclusions:

• Scenario: Automated Backup Scripts Executing PowerShell Tools

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize custom .exe files or PowerShell scripts wrapped in .NET to manage data snapshots. These tools frequently include names like Veeam.Backup.Engine.exe or custom scripts named BackupAgent_v2.dll.
  • Filter/Exclusion: Create an exclusion for the specific process image paths located within the vendor’s installation directory (e.g., C:\Program Files\Veeam\*) and exclude processes where the command line contains keywords like “backup”, “snapshot”, or “agent”.

• Scenario: Scheduled Patching Jobs Using .NET Wrappers

  • Context: System administrators often deploy scheduled tasks using tools like SCCM (Configuration Manager) or WSUS that invoke .NET-based patching utilities. A common trigger is a tool named PatchOrchestrator.exe running under the SYSTEM account during maintenance windows.
  • Filter/Exclusion: Filter based on the parent process being TaskScheduler.exe and the user context being NT AUTHORITY\SYSTEM. Additionally, exclude processes where the file hash matches a known baseline of approved patching tools.

• Scenario: Endpoint Detection and Response (EDR) Self-Scanning

  • Context: The organization’s own EDR agent (e.g., CrowdStrike Falcon or Carbon Black) may spawn internal .NET components for real-time scanning or policy updates. These internal binaries often have names resembling threat hunting tools, such as FalconSensorService.exe or CarbonBlackAgent.dll, which can be mistaken for external red-team tools.
  • **Filter