detect Armadill(a variant of RedLeaves) in memory

Hunt Hypothesis

This hunt targets the presence of Armadillo, a RedLeaves variant, within system memory to identify early-stage reconnaissance or lateral movement activities characteristic of this threat actor. Proactively hunting for these specific memory artifacts in Azure Sentinel is critical to validate low-severity alerts and ensure rapid containment before the adversary establishes persistent footholds or escalates its operations.

YARA Rule

rule Armadill {
          meta:
            description = "detect Armadill(a variant of RedLeaves) in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"

          strings:
            $a1 = { C7 ?? ?? 41 72 6D 61 }
            $a2 = { C7 ?? ?? 64 69 6C 6C }

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Armadill (RedLeaves variant) detection rule, including suggested filters and exclusions:

• Endpoint Protection Scanning via Scheduled Jobs

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint perform routine deep memory scans. These tools often inject their own scanning modules into the address space of critical system processes, mimicking the memory injection behavior characteristic of Armadill/RedLeaves.
  • Suggested Filter: Exclude alerts where the parent process is a known security agent (e.g., CrowdStrike.exe, SentinelOneAgent.exe, MsMpEng.exe) and the injected module name matches the vendor’s signature library (e.g., containing “Sensor”, “Guard”, or “Antimalware”).

• Software Deployment via Configuration Management Tools

  • Scenario: Automated patch management tools such as Ansible, SCCM (Microsoft Endpoint Configuration Manager), or Jamf Pro execute deployment scripts that dynamically load custom DLLs into memory to verify installation status. These legitimate administrative tasks often involve loading unsigned or internally signed modules into svchost.exe or dedicated service runners, triggering the “variant in memory” signature.
  • Suggested Filter: Create an exclusion for processes launched by known deployment orchestrators (e.g., ccmexec.exe, ansible-runner.py) where the loaded module path resides within a trusted software distribution directory (e.g., C:\Program Files\Microsoft SCCM\ or /var/opt/jamf/).

• Database Maintenance and Reporting Services

  • Scenario: Enterprise database engines like Oracle Database, SQL Server, or SAP HANA run scheduled maintenance jobs that load in-memory extensions for real-time analytics