Detects .NET red/black-team tools via name

Hunt Hypothesis

This detection identifies the execution of known .NET-based red and blue team utility names to distinguish legitimate security testing activities from potential adversary tooling that mimics these signatures. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to validate authorized internal exercises while reducing alert fatigue and uncovering stealthy attacks that leverage similar .NET frameworks to evade traditional detection.

YARA Rule

rule HKTL_NET_NAME_trevorc2 {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/trustedsec/trevorc2"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "trevorc2" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/trustedsec/trevorc2
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters and exclusions:

• Scenario: Automated Backup Scripts on File Servers

  • Context: Enterprise file servers often run scheduled PowerShell or C# scripts (e.g., BackupAgent.exe, Veeam.NET.Service) that utilize .NET frameworks to manage data. These processes frequently match the naming patterns of security tools like Sysmon or custom red-team agents.
  • Filter/Exclusion: Create an exclusion based on the specific process name (e.g., Veeam.NET.Service.exe, BackupAgent.exe) combined with a known parent process (e.g., TaskScheduler.exe or svchost.exe). Additionally, exclude these processes if they are running from a trusted administrative path like C:\Program Files\Veeam\.

• Scenario: Endpoint Protection Console Updates

  • Context: Security suites such as Microsoft Defender for Endpoint, CrowdStrike Falcon, or Carbon Black often include .NET-based management consoles (e.g., DefenderAgent.exe, FalconSensorService.exe) that perform routine health checks and policy downloads. These tools inherently contain “red-team” style capabilities, causing them to trigger the rule during normal update cycles.
  • Filter/Exclusion: Filter out processes where the file path matches the vendor’s installation directory (e.g., C:\Program Files\Microsoft Defender Antivirus\) and the digital signature is verified by the respective vendor (Microsoft, CrowdStrike). Exclude any process name containing “Defender”, “Falcon”, or “Carbon” if the publisher certificate is trusted.

• Scenario: HR and Payroll System Scheduled Jobs

  • Context: Internal enterprise applications built on .NET Core for HR management (e.g., Workday agents, SAP Success