IsNET DLL

Hunt Hypothesis

This rule identifies potentially malicious .NET DLLs that adversaries may deploy to establish persistence or execute network-based exploitation payloads. Proactively hunting for these files in Azure Sentinel helps detect stealthy implantation of managed code that traditional signature-based detections might miss, reducing the risk of undetected lateral movement or backdoor establishment.

YARA Rule

rule IsNET_DLL : PECheck
{
	condition:
		pe.imports ("mscoree.dll","_CorDllMain")
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Scenario: Deployment of .NET-based administrative utilities or SDKs (e.g., Microsoft.IdentityModel.Clients.ActiveDirectory.dll or System.Net.Http.dll) during application updates or developer onboarding.

  • Filter/Exclusion: Exclude files located in standard .NET framework directories (e.g., C:\Windows\Microsoft.NET\Framework64\v4.0.30319\) or known application installation paths (e.g., C:\Program Files\Microsoft Visual Studio\) where the parent process is a recognized installer or build tool (e.g., msiexec.exe, dotnet.exe).

• Scenario: Execution of legitimate .NET CLI tools or build agents in CI/CD pipelines (e.g., dotnet build, nuget restore) that load temporary or compiled DLLs in working directories like C:\temp or C:\builds.

  • Filter/Exclusion: Exclude DLLs loaded by processes named dotnet.exe, msbuild.exe, or nuget.exe if the file path contains keywords like bin, obj, or packages and the file age is less than 24 hours.

• Scenario: Scheduled maintenance jobs using PowerShell or custom .NET scripts that load helper DLLs from shared network drives (e.g., \\fileserver\tools\) for inventory collection or log rotation.

  • Filter/Exclusion: Exclude DLLs where the source path is a UNC path (\\server\share) and the loading process is a known service account or scheduled task executor (e.g., svchost.exe with specific service names, or powershell.exe invoked by TaskScheduler), provided the DLL hash is in a trusted baseline.

• Scenario: Antivirus or EDR agent self-updates or plugin loads that temporarily place .NET