9002 Identifying Strings

Hunt Hypothesis

Adversaries may use specific strings to execute malicious payloads or exfiltrate data, which can indicate the presence of a targeted attack. SOC teams should proactively hunt for these string patterns in Azure Sentinel to identify potential compromise and mitigate lateral movement risks.

YARA Rule

rule APT9002Strings
{
    
    meta:
        description = "9002 Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    strings:
        $ = "POST http://%ls:%d/%x HTTP/1.1"
        $ = "%%TEMP%%\\%s_p.ax" wide ascii
        $ = "%TEMP%\\uid.ax" wide ascii
        $ = "%%TEMP%%\\%s.ax" wide ascii
        // also triggers on surtr $ = "mydll.dll\x00DoWork"
        $ = "sysinfo\x00sysbin01"
        $ = "\\FlashUpdate.exe"

    condition:
       any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Scenario: A system administrator is using strings to analyze a binary file for debugging purposes.
  Filter/Exclusion: Exclude processes where the command line contains strings and the file being analyzed is a known system binary or located in /usr/bin/ or /bin/.

• Scenario: A scheduled job runs a script that uses strings to extract text from log files for analysis.
  Filter/Exclusion: Exclude processes where the command line includes strings and the file path starts with /var/log/ or /tmp/.

• Scenario: A developer is using strings to inspect a compiled library or executable during development.
  Filter/Exclusion: Exclude processes where the command line contains strings and the file path is within a development directory (e.g., /home/dev/project/).

• Scenario: A security tool like ClamAV or Sophos is scanning files and temporarily uses strings as part of its analysis.
  Filter/Exclusion: Exclude processes where the parent process is a known antivirus or endpoint protection tool (e.g., clamscan, sophos-antivirus).

• Scenario: An admin is using strings to extract data from a disk image or memory dump for forensic analysis.
  Filter/Exclusion: Exclude processes where the command line includes strings and the file path is a memory dump or disk image (e.g., /mnt/diskimage.dmp, /tmp/memdump).