Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based offensive and defensive utilities by matching process names against a curated list of Red Team and Blue Team tooling signatures. Proactive hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate security operations from adversarial activity that mimics standard administrative tools to evade detection.

YARA Rule

rule HKTL_NET_NAME_StageStrike {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/RedXRanger/StageStrike"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "StageStrike" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/RedXRanger/StageStrike
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters and exclusions:

• Scheduled Backup Jobs Using PowerShell Modules

  • Scenario: Enterprise backup solutions (e.g., Veeam, Rubrik) often utilize custom .NET assemblies or PowerShell modules named Veeam.Backup.Service.exe or similar to perform nightly data snapshots. These processes frequently match the naming pattern of security tools because they are built on the .NET framework and execute in the background.
  • Filter/Exclusion: Create an exclusion based on the specific process image path (e.g., C:\Program Files\Veeam\Backup and Replication\...) or filter by parent process if the backup job is triggered by a known scheduler service like TaskScheduler.exe.

• Endpoint Protection Agent Updates

  • Scenario: Modern Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, frequently spawn .NET worker processes named FalconSensorService.exe or MsMpEngCore.dll to handle real-time scanning and policy updates. These internal components often mimic the naming conventions of external red/blue team tools.
  • Filter/Exclusion: Exclude processes where the file publisher is a known security vendor (e.g., “CrowdStrike, Inc.” or “Microsoft Corporation”) via the FilePublisher attribute in the event log, ensuring only unknown publishers trigger alerts for this specific rule.

• CI/CD Pipeline Build Agents

  • Scenario: In DevOps environments, build servers like Jenkins, Azure DevOps, or GitHub Actions runners execute .NET-based compilation and testing tools (e.g., dotnet.exe, MSBuild.exe) within the agent containers or VMs. These tools are legitimate but may be flagged as “red-team” reconnaissance