Bandook

Hunt Hypothesis

This detection identifies the presence of the Bandook malware family by matching file artifacts against specific YARA signatures within the Azure Sentinel environment. Proactively hunting for this low-severity indicator allows the SOC team to validate initial detections and uncover potential lateral movement or persistence mechanisms before they escalate into higher-impact incidents.

YARA Rule

rule Bandook : RAT
{

	meta:
		author = " Kevin Breen <[email protected]>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/bandook"
		maltype = "Remote Access Trojan"
		filetype = "exe"
        
    strings:
    		$a = "aaaaaa1|"
            $b = "aaaaaa2|"
            $c = "aaaaaa3|"
            $d = "aaaaaa4|"
			$e = "aaaaaa5|"
			$f = "%s%d.exe"
			$g = "astalavista"
			$h = "givemecache"
			$i = "%s\\system32\\drivers\\blogs\\*"
			$j = "bndk13me"
			

        
    condition:
    		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Bandook detection rule in an enterprise environment, including suggested filters and exclusions:

• Antivirus Real-Time Scanning of Large Archives

  • Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently trigger the Bandook signature when scanning large .zip or .tar.gz archives containing legitimate software installers. The YARA rule may match a specific byte sequence within the archive header that coincides with the malware’s packing algorithm, causing alerts during routine background scans of user downloads folders (C:\Users\Public\Downloads).
  • Filter/Exclusion: Create an exclusion for processes running under MsMpEng.exe (Defender) or csfalconagent.exe (CrowdStrike) when the target file path contains \Downloads\ and the file extension is .zip, .tar.gz, or .7z. Alternatively, tune the YARA rule to require a minimum entropy threshold of 0.85 to distinguish between packed archives and actual executable binaries.

• Scheduled Software Deployment via SCCM/Intune

  • Scenario: During business hours (e.g., 9:00 AM – 11:00 AM), the Microsoft Endpoint Configuration Manager (MECM) or Microsoft Intune agent (ccmexec.exe / IntuneManagementExtension) deploys updated versions of enterprise applications like Adobe Acrobat Reader or Zoom. The deployment process extracts temporary installer files to %TEMP% which contain digital signatures and embedded scripts that match the Bandook detection logic, triggering alerts on thousands of workstations simultaneously.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmexec.exe, IntuneManagementExtension.exe, or msiexec.exe and