NETexecutableMicrosoft

Hunt Hypothesis

This detection identifies Microsoft .NET executables that may indicate an adversary leveraging managed code to establish persistence or execute malicious payloads within the environment. Proactive hunting for these artifacts in Azure Sentinel is essential to uncover stealthy threats that often evade traditional signature-based defenses by utilizing legitimate .NET frameworks to mask their activities.

YARA Rule

rule NETexecutableMicrosoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NETexecutableMicrosoft detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Microsoft Office Click-to-Run Self-Updates

  • Context: The OfficeClickToRun.exe process frequently spawns child processes (e.g., OfficeC2RClient.exe) that execute .NET assemblies to handle background updates, feature installations, or license renewals. These often trigger the rule when they load managed code dynamically.
  • Filter/Exclusion: Exclude processes where the parent image path matches *Program Files*\Microsoft Office*\root\Office16\OfficeClickToRun.exe and the child process name contains OfficeC2RClient. Alternatively, add a filter to ignore events where the file hash of the executable matches known Microsoft-signed hashes for the Click-to-Run suite.

• Scenario: Scheduled PowerShell Maintenance Jobs

  • Context: Enterprise IT teams often deploy scheduled tasks (via Task Scheduler) that run PowerShell scripts (.ps1) or compiled .NET assemblies to perform nightly log rotation, inventory collection, or compliance reporting. These jobs invoke powershell.exe which subsequently loads .NET components, triggering the rule.
  • Filter/Exclusion: Create an exclusion based on the “Scheduled Task Name” field in the event data. Filter out events where the task name matches patterns like Microsoft-Office-Update, Sysmon-Inventory, or Compliance-Daily-Report. Ensure the filter validates that the process command line contains specific internal script paths (e.g., C:\Scripts\Internal\).

• Scenario: Endpoint Protection Engine Scanning

  • Context: Modern EDR solutions like Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne utilize .NET-based modules for real-time scanning and heuristic analysis. When these agents