Adzok

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Adzok malware family to establish initial footholds within Azure workloads by executing known malicious binaries identified through YARA signatures. Proactive hunting for this behavior in Azure Sentinel is critical because early detection of these low-severity indicators can reveal broader compromise patterns before they escalate into high-impact incidents, ensuring timely containment across the cloud environment.

YARA Rule

rule Adzok : binary RAT Adzok
{
	meta:
		author = " Kevin Breen <[email protected]>"
		Description = "Adzok Rat"
		Versions = "Free 1.0.0.3,"
		date = "2015/05"
		ref = "http://malwareconfig.com/stats/Adzok"
		maltype = "Remote Access Trojan"
		filetype = "jar"

	strings:
		$a1 = "config.xmlPK"
		$a2 = "key.classPK"
		$a3 = "svd$1.classPK"
		$a4 = "svd$2.classPK"
    	$a5 = "Mensaje.classPK"
		$a6 = "inic$ShutdownHook.class"
		$a7 = "Uninstall.jarPK"
		$a8 = "resources/icono.pngPK"
        
	condition:
    7 of ($a*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Adzok detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Management Agent Updates

  • Scenario: The Adzok YARA signature detects the core executable of a widely used endpoint management suite (e.g., Microsoft Intune, Tanium, or CrowdStrike Falcon) during its scheduled daily policy synchronization. These agents often inject code into user sessions to enforce compliance, mimicking the behavior patterns flagged by Adzok.
  • Filter/Exclusion: Create a process exclusion for the specific agent executables (e.g., C:\Program Files\Microsoft Intune Management Extension\IntuneManagementExtension.exe or C:\ProgramData\CrowdStrike\csagent.exe) and their child processes when running under the SYSTEM account.

• Scheduled Software Deployment via SCCM/MECM

  • Scenario: A nightly maintenance window triggers a software deployment job using Microsoft Endpoint Configuration Manager (SCCM/MECM). The deployment engine (ccmexec.exe) launches a temporary installer wrapper that matches the Adzok signature while distributing updates to workstations. This is often mistaken for an unauthorized binary execution.
  • Filter/Exclusion: Exclude process paths containing C:\Windows\CCM\ or C:\Program Files (x86)\Microsoft Configuration Manager\. Additionally, add a time-based filter to suppress alerts between 02:00 and 04:00 UTC on weekdays when these scheduled jobs typically run.

• IT Admin Manual Patching with Deployment Tools

  • Scenario: An IT administrator manually runs a patch management tool like PDQ Deploy or Chocolatey to push critical security updates to a specific server group. The installer executable launched by the admin (e.g