Bozok

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Bozok malware family to establish persistence or execute initial reconnaissance within Azure workloads, as indicated by specific YARA signature matches. Proactive hunting for this low-severity indicator is essential to validate its benign nature and identify potential early-stage lateral movement before it escalates into a critical incident.

YARA Rule

rule Bozok : RAT
{
	meta:
		author = " Kevin Breen <[email protected]>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Bozok"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "getVer" nocase
		$b = "StartVNC" nocase
		$c = "SendCamList" nocase
		$d = "untPlugin" nocase
		$e = "gethostbyname" nocase

	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Bozok detection rule in an enterprise environment, including suggested filters and exclusions:

• Antivirus Definition Updates via Windows Update Agent

  • Scenario: The Bozok rule often triggers on the MpCmdRun.exe or MsMpEng.exe processes when they download and install new definition packs. These legitimate updates involve creating temporary files, unpacking archives, and modifying registry keys that mimic the file creation patterns of a potential threat.
  • Filter/Exclusion: Add an exclusion for the process path C:\Program Files\Windows Defender\MpCmdRun.exe and C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MpEng.dll. Additionally, filter out events where the parent process is svchost.exe with the service name Wuauserv (Windows Update).

• Scheduled Log Rotation by Splunk Universal Forwarder

  • Scenario: The rule detects activity when the Splunk Universal Forwarder (splunkd.exe) executes its scheduled log rotation job. This process compresses old logs into .gz or .zip archives and moves them to a staging directory, generating file system events that match the Bozok signature for “suspicious file manipulation.”
  • Filter/Exclusion: Exclude file paths containing C:\Program Files\SplunkUniversalForwarder\var\splunk\log. Create a filter based on the scheduled task name \Microsoft\Splunk\RotateLogs to suppress alerts generated during this specific maintenance window.

• Software Deployment via Microsoft SCCM (Configuration Manager)

  • Scenario: During enterprise-wide software deployments, the ccmexec.exe service extracts application packages into temporary folders (C:\Windows\CCMCache) before installation. The Bozok rule may flag the rapid creation