IsNET EXE

Hunt Hypothesis

This rule identifies executable files that are compiled with the .NET framework, a common choice for adversaries to develop custom malware or implant tools due to its cross-platform capabilities and ease of development. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to isolate and analyze potentially suspicious .NET binaries before they execute, helping to detect stealthy implants or post-exploitation tools that may blend in with legitimate application traffic.

YARA Rule

rule IsNET_EXE : PECheck
{
	condition:
		pe.imports ("mscoree.dll","_CorExeMain")
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Visual Studio Build Agent Execution: During automated CI/CD pipelines, the Microsoft Visual Studio Build Agent (typically vstest.console.exe or msbuild.exe) executes .NET assemblies to compile and test code. This is a standard, high-frequency task in development environments.
  • Filter/Exclusion: Exclude processes where the parent process is VSTest.console.exe or MSBuild.exe, or filter by path containing \bin\ and *.dll in the command line arguments.
• PowerShell Script Execution via .NET Host: Administrators frequently use powershell.exe to execute scripts that invoke .NET assemblies (e.g., System.Management.Automation or custom internal tools) for configuration management or reporting. The underlying host process may be identified as a .NET executable.
  • Filter/Exclusion: Exclude if the parent process is powershell.exe or pwsh.exe and the working directory is a known admin script repository (e.g., C:\Admin\Scripts\ or C:\Program Files\CorpTools\).
• SQL Server Agent Job Execution: SQL Server Agent jobs often run T-SQL scripts that call .NET assemblies for data transformation, reporting, or integration with other enterprise systems. The execution context may spawn a .NET host process.
  • Filter/Exclusion: Exclude processes where the parent process is sqlagent.exe or sqlservr.exe, or where the command line contains SQLCLR or references to specific database integration DLLs.
• Internal Enterprise Application Updates: Many enterprise applications (e.g., SAP, Oracle, or custom internal portals) use .NET-based updaters or background services to check for patches or synchronize data. These often run as scheduled tasks or services.
  • Filter/Exclusion: Exclude known internal application updater executables by name