Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule identifies the execution of known .NET-based offensive and defensive security tools by monitoring process names for signatures associated with Red Team or Black Team activities. Proactively hunting for these indicators in Azure Sentinel enables the SOC to distinguish legitimate security operations from potential adversary tradecraft that mimics standard tooling, thereby reducing noise and improving threat visibility.

YARA Rule

rule HKTL_NET_NAME_WMIPersistence {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/mdsecactivebreach/WMIPersistence"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "WMIPersistence" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/mdsecactivebreach/WMIPersistence
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents often utilize .NET-based executables (e.g., AppDeploymentClient.exe, DeviceHealthService.exe) to deploy patches and software updates. These tools frequently spawn child processes with names resembling red/blue team utilities during the installation phase.
  • Filter/Exclusion: Create an exclusion based on the Parent Process Name (ccmsetup.exe or Microsoft.IntuneManagementExtension.exe) combined with a specific Path Hash. Exclude alerts where the parent process is known enterprise management software and the file path resides within standard system directories (e.g., C:\Program Files\Microsoft Intune Management Extension\).

• Scenario: Scheduled Backup Jobs Using .NET Agents

  • Context: Enterprise backup solutions like Veeam or Rubrik often employ .NET-based agents (Veeam.Backup.Service.exe, RubrikAgentService.exe) that run on a schedule. These agents may spawn temporary processes with names similar to forensic tools (e.g., containing “Collector” or “Scanner”) to index data before archiving.
  • Filter/Exclusion: Implement a filter based on Scheduled Task Name and Process Command Line. Exclude alerts where the process is launched by Task Scheduler (svchost.exe with specific arguments) and the command line contains backup-specific keywords (e.g., “Backup”, “Archive”, “Snapshot”) rather than security tool signatures.

• Scenario: Internal DevOps Pipeline Execution

  • Context: CI/CD pipelines (Jenkins, Azure DevOps, GitHub Actions) often run .NET build agents