Detects hiZor RAT

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the hiZor Remote Access Trojan to establish persistent command-and-control channels and exfiltrate sensitive data from endpoints within the Azure environment. Proactively hunting for this specific threat is critical because its low-severity classification may cause it to be overlooked in standard alerting, necessitating a targeted search to validate early-stage infection before lateral expansion occurs.

YARA Rule

rule apt_win32_dll_rat_hiZor_RAT: RAT
{
	meta:
    description = "Detects hiZor RAT"
		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
		hash2 = "d9821468315ccd3b9ea03161566ef18e"
		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
    ref1 = "http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html"
    ref2 = "https://github.com/Neo23x0/Loki/blob/b187ed063d73d0defc6958100ca7ad04aa77fc12/signatures/apt_hizor_rat.yar"
    reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
	strings:
		// Part of the encoded User-Agent = Mozilla
		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }

		// XOR to decode User-Agent after string stacking 0x10001630
		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }

		// XOR with 0x2E - 0x10002EF6
		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }

		$s4 = "CmdProcessExited" wide ascii
		$s5 = "rootDir" wide ascii
		$s6 = "DllRegisterServer" wide ascii
		$s7 = "GetNativeSystemInfo" wide ascii
		$s8 = "%08x%08x%08x%08x" wide ascii
	condition:
		(uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f) and (all of them)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects hiZor RAT rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Management Agent Updates via PowerShell

  • Scenario: The enterprise Endpoint Detection and Response (EDR) agent or Group Policy client executes a scheduled PowerShell script to update remote management tools. These scripts often spawn child processes with high network activity and memory injection behaviors that mimic the hiZor RAT’s communication patterns, specifically when connecting to internal update servers on non-standard ports.
  • Filter/Exclusion: Exclude process paths containing C:\Program Files\Microsoft Intune Management Extension or C:\Windows\System32\GroupPolicyClient. Additionally, filter out network connections where the destination IP belongs to the internal management subnet (e.g., 10.x.x.x) and the user context is a system account (NT AUTHORITY\SYSTEM).

• IT Helpdesk Remote Support Sessions

  • Scenario: IT administrators utilize remote support tools like BeyondTrust (BTS) or SolarWinds RMM to troubleshoot user workstations. When an admin initiates a “Remote Control” session, the tool injects code into the target process and establishes persistent encrypted channels, which can trigger the hiZor RAT detection logic due to similar API hooking and command-and-control (C2) behaviors.
  • Filter/Exclusion: Create an exclusion for processes running under specific administrative service accounts (e.g., DOMAIN\svc_remote_support) or exclude known executable hashes of legitimate remote support agents. A time-based filter can also be applied to suppress alerts during standard business hours (08:00–18:00) when these sessions are most frequent.

• Automated Software Deployment via SCCM/MECM

  • Scenario: During scheduled maintenance windows, the **