Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based Red and Black team utility names to distinguish legitimate security operations from potential adversary tooling that mimics these signatures. Proactive hunting for this behavior in Azure Sentinel is essential to reduce false positives during incident response and to uncover stealthy attackers leveraging familiar .NET frameworks to blend into normal administrative activity.

YARA Rule

rule HKTL_NET_NAME_tvasion {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/loadenmb/tvasion"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "tvasion" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/loadenmb/tvasion
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters and exclusions:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build servers (e.g., Azure DevOps, Jenkins) frequently execute .exe files named dotnet.exe, msbuild.exe, or specific test runners like vstest.console.exe during nightly builds. These tools often reside in build agent directories rather than standard application folders.
  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD service (e.g., VSTS.Agent.exe, jenkins-agent.exe) or restrict detection to specific build server hostnames and paths (e.g., C:\BuildAgents\*).

• Scenario: Scheduled Backup or Reporting Jobs

  • Context: Enterprise reporting tools (such as Power BI Report Server agents or custom .NET inventory scripts) run on a schedule. These jobs often utilize generic names like ReportServerService.exe or InventoryAgent.exe which may match the rule’s keyword list for “black-team” monitoring tools.
  • Filter/Exclusion: Create an exclusion based on scheduled task names (e.g., exclude if parent process is svchost.exe running a specific Task Scheduler ID) or filter by file path containing keywords like \Reports\, \Backup\, or \Scripts\.

• Scenario: Endpoint Protection Scanning

  • Context: Modern EDR solutions (e.g., CrowdStrike, SentinelOne, Microsoft Defender) often include .NET-based components for real-time scanning or threat hunting. These components may be named C-Defense.exe, SentinelAgent.exe, or generic names like SecurityMonitor.exe that mimic the naming convention of red/blue team tools.

  ---