Detects .NET red/black-team tools via name

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging custom or known .NET-based Red and Blue team utilities that may be used to establish persistence or conduct reconnaissance within the environment. Proactively hunting for these tools in Azure Sentinel is critical because their legitimate appearance can mask malicious activity, allowing attackers to operate under the radar while utilizing familiar .NET naming conventions to evade standard detection mechanisms.

YARA Rule

rule HKTL_NET_NAME_shellcodeTester {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/tophertimzen/shellcodeTester"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "shellcodeTester" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/tophertimzen/shellcodeTester
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the HKTL_NET_NAME detection rule, which targets .NET red/black team tools by filename:

• Scenario: Legitimate DevOps Build Agents Running MSBuild Tasks

  • Context: In an enterprise environment with active CI/CD pipelines (e.g., Azure DevOps or Jenkins), build agents frequently execute MSBuild.exe or dotnet.exe to compile applications. These processes often spawn child .NET processes that match the naming patterns of common security tools like Cobalt Strike Beacon or BloodHound.
  • Filter/Exclusion: Create an exclusion based on the parent process path and name. Exclude alerts where the parent process is vstest.exe, msbuild.exe, or dotnet.exe located within standard build agent directories (e.g., C:\Program Files\Microsoft Visual Studio\... or D:\BuildAgents\).

• Scenario: Scheduled Backup Jobs Utilizing .NET Framework

  • Context: Enterprise backup solutions (such as Veeam, Commvault, or custom scripts) often utilize .NET-based executables for data processing. A scheduled job might launch a tool named BackupAgent.exe or SyncService.exe, which shares naming conventions with black-team reconnaissance tools like SharpUp or PowerSploit.
  • Filter/Exclusion: Implement a filter excluding processes running under the context of known service accounts (e.g., NT SERVICE\VeeamTransport) and restrict detection to specific time windows outside of peak backup hours, or exclude paths containing keywords like \Backup\, \Veeam\, or \Commvault\.

• Scenario: Internal IT Automation Scripts for User Provisioning

  • Context: The Identity & Access Management (IAM) team runs daily PowerShell scripts compiled as .NET executables