detect Agenttesla in memory

Hunt Hypothesis

This hunt targets adversaries utilizing the AgentTesla remote access trojan to establish persistent memory-based footholds within endpoints for credential harvesting and lateral movement. Proactively searching for this behavior in Azure Sentinel is critical because early detection of AgentTesla’s in-memory artifacts allows SOC teams to mitigate silent data exfiltration before it escalates into a broader compromise, despite the rule’s current low severity classification.

YARA Rule

rule Agenttesla_type2 {
          meta:
            description = "detect Agenttesla in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"
            hash1 = "670a00c65eb6f7c48c1e961068a1cb7fd3653bd29377161cd04bf15c9d010da2 "

          strings:
            $type2db1 = "1.85 (Hash, version 2, native byte-order)" wide
            $type2db2 = "Unknow database format" wide
            $type2db3 = "SQLite format 3" wide
          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 4 specific scenarios where the detect Agenttesla in memory rule may generate false positives in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Management Deployment via SCCM/MECM

  • Scenario: During a scheduled maintenance window, System Center Configuration Manager (SCCM) deploys a new software package or security update. The deployment agent (ccmexec.exe) launches the Agenttesla binary as a child process to verify system integrity before installing updates on thousands of workstations simultaneously.
  • Filter/Exclusion: Create an exclusion for processes where the parent process name is ccmexec.exe and the command line contains specific SCCM deployment IDs (e.g., --deployment-id=ABC123). Additionally, exclude events occurring during defined maintenance windows (e.g., Sundays 02:00–06:00 UTC).

• Third-Party Vulnerability Scanner Execution

  • Scenario: A scheduled vulnerability assessment job runs using tools like Tenable Nessus or Qualys. These scanners often inject a lightweight agent (Agenttesla) into memory to perform real-time configuration checks and patch verification without requiring a full reboot, triggering the rule across multiple servers in the DMZ.
  • Filter/Exclusion: Filter out events where the process path resides within the vendor’s installation directory (e.g., C:\Program Files\Tenable\Nessus\Agenttesla.exe) and is initiated by known service accounts such as NT AUTHORITY\SYSTEM or specific domain groups like svc_vuln_scan.

• ITSM Ticket Resolution via PowerShell Automation

  • Scenario: An IT administrator executes a custom PowerShell script (Resolve-HardwareHealth.ps1) to address a batch of hardware health tickets. The script dynamically loads the Agenttesla module into memory to