Detects .NET red/black-team tools via name

Hunt Hypothesis

This rule detects the execution of known .NET-based offensive and defensive security tools by matching process names against a curated list of Red Team and Black Team utilities. Proactively hunting for these artifacts in Azure Sentinel is essential to distinguish legitimate security operations from adversarial activity that may mimic trusted tooling to evade detection or establish persistence.

YARA Rule

rule HKTL_NET_NAME_xbapAppWhitelistBypassPOC {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/jpginc/xbapAppWhitelistBypassPOC"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "xbapAppWhitelistBypassPOC" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://github.com/jpginc/xbapAppWhitelistBypassPOC
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects .NET red/blue-team tools via name,” along with suggested filters and exclusions:

• Scenario: Automated Backup Jobs Executing dotnet or Specific Tool Names

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize .NET-based agents that run scheduled tasks. These agents may spawn processes named similarly to security tools (e.g., Veeam.Backup.Service.exe containing “Backup” and ”.NET”) or explicitly invoke dotnet.exe with arguments matching known red-team tool signatures during nightly maintenance windows.
  • Filter/Exclusion: Create an exclusion based on the Parent Process Name (e.g., vssvc.exe, commvault_agent.exe) combined with a Time-of-Day filter to allow activity only between 02:00 and 06:00. Additionally, exclude processes running under specific service accounts like NT SERVICE\VeeamBackup.

• Scenario: CI/CD Pipeline Build Agents Running .NET Workflows

  • Context: DevOps teams using Azure DevOps or Jenkins often deploy build agents that execute .NET compilation tasks. These agents frequently run tools named msbuild.exe, nuget.exe, or generic dotnet processes which may match the name patterns of red-team reconnaissance tools (like SharpUp or PowerSploit) due to shared naming conventions in the .NET ecosystem.
  • Filter/Exclusion: Exclude process execution where the User Account matches known build service identities (e.g., AZDO-BUILD-SVC, Jenkins-Agent-01). Furthermore, filter out events originating from specific IP ranges dedicated to the CI/CD infrastructure subnet.

• **Scenario: IT Admin Performing Legitimate PowerShell Scripting with .NET