The CommentCrew-threat-apt1 rule detects potential adversary behavior involving suspicious comment creation or modification in Azure resources, which may indicate reconnaissance or persistent access. SOC teams should proactively hunt for this behavior to identify early-stage threats and prevent lateral movement within cloud environments.
YARA Rule
rule APT1_MAPIGET
{
meta:
author = "AlienVault Labs"
info = "CommentCrew-threat-apt1"
strings:
$s1 = "%s\\Attachment.dat" wide ascii
$s2 = "MyOutlook" wide ascii
$s3 = "mail.txt" wide ascii
$s4 = "Recv Time:" wide ascii
$s5 = "Subject:" wide ascii
condition:
all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 5 string patterns in its detection logic.
Scenario: A system administrator is using PowerShell to generate a report for a scheduled job, which includes the string “CommentCrew” in the script due to a naming convention.
Filter/Exclusion: Exclude events where the script path contains C:\Windows\System32\WindowsPowerShell\v1.0\ or where the process is powershell.exe and the command line includes report-generate.ps1.
Scenario: A SQL Server Agent Job runs a stored procedure that includes a comment with “CommentCrew” as part of a documentation standard.
Filter/Exclusion: Exclude events where the process is sqlagent.exe and the job name contains SQLServerAgentJob_Reporting.
Scenario: A Windows Task Scheduler job is configured to run a batch file that includes a comment line with “CommentCrew” for internal documentation purposes.
Filter/Exclusion: Exclude events where the process is schtasks.exe and the task name contains Internal_Documentation_Task.
Scenario: A Windows Event Log entry is generated by a legitimate Event Viewer task that includes the term “CommentCrew” in a custom log message for debugging.
Filter/Exclusion: Exclude events where the source is EventLog and the event ID is within the range of system-generated events (e.g., 600–699).
Scenario: A Docker container running a legitimate application logs a message with “CommentCrew” as part of its internal logging framework.
Filter/Exclusion: Exclude events where the process name contains docker and the container ID matches a known internal container ID or image name.