detect Azorult in memory

Hunt Hypothesis

This detection rule identifies the in-memory execution of the Azorult infostealer, which often evades traditional file-based scanning by operating without writing artifacts to disk. Proactively hunting for this behavior in Azure Sentinel is critical because early identification allows SOC teams to isolate compromised endpoints before sensitive credentials and browsing data are exfiltrated.

YARA Rule

rule Azorult {
          meta:
            description = "detect Azorult in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"

          strings:
            $v1 = "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)"
            $v2 = "http://ip-api.com/json"
            $v3 = { c6 07 1e c6 47 01 15 c6 47 02 34 }

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “detect Azorult in memory” rule within an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Scanning Processes

  • Scenario: Antivirus or EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently inject their own scanning modules into the memory of running processes to perform real-time heuristic analysis. These injected components often load DLLs with signatures similar to Azorult’s known memory structures, triggering a match even though no malicious activity is occurring.
  • Filter/Exclusion: Exclude alerts where the parent process is a known security product (e.g., CrowdStrike.exe, MsMpEng.exe) or filter by the specific hash of the injected DLL if it matches the vendor’s official signature database.

• Software Deployment and Patch Management Jobs

  • Scenario: Automated deployment tools like Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager execute scheduled tasks to install updates or deploy applications. During these operations, they spawn temporary worker processes that load installation packages into memory; these packages often contain compressed archives with file structures mimicking the Azorult loader mechanism.
  • Filter/Exclusion: Create an exclusion for alerts originating from specific Service Accounts (e.g., DOMAIN\SCCM-Deploy-Svc) or filter by command-line arguments containing known deployment identifiers (e.g., --install, --patch, /taskid:12345).

• Enterprise Application Runtime Environments

  • Scenario: Heavy enterprise applications such as SAP GUI, Oracle Client, or Citrix Workspace utilize complex runtime environments that dynamically load numerous shared libraries. These legitimate applications often instantiate memory regions with high entropy and specific API call sequences that overlap with the behavioral profile of Azorult, particularly during initial user login