CSIT 14003 03

Hunt Hypothesis

This detection identifies the execution of specific file patterns defined by the CSIT_14003_03 YARA signature, which likely indicates early-stage adversary activity such as benign tool usage or initial reconnaissance. Proactively hunting for these low-severity events in Azure Sentinel allows the SOC team to establish a behavioral baseline and correlate isolated findings with broader attack chains before they escalate into critical incidents.

YARA Rule

rule CSIT_14003_03 : installer RAT
{ 
    meta:
        Author      = "CrowdStrike, Inc"
        Date        = "2014/05/13"
        Description = "Flying Kitten Installer"
        Reference   = "http://blog.crowdstrike.com/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten"

    strings:
        $exename = "IntelRapidStart.exe"
        $confname = "IntelRapidStart.exe.config"
        $cabhdr = { 4d 53 43 46 00 00 00 00 } 

    condition:
        all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the CSIT 14003 03 detection rule, tailored for an enterprise environment:

• Antivirus Scheduled Scans and Updates

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec) frequently execute scheduled scans or download definition updates. These processes often spawn child processes that match the YARA signature’s behavioral patterns, specifically when scanning temporary directories or extracting compressed update packages.
  • Filter/Exclusion: Create an exclusion based on the parent process image path and command line arguments containing keywords like scan, update, or specific vendor executable names (e.g., C:\Program Files\CrowdStrike\fs.exe with args containing /schedule).

• Software Deployment via SCCM or Intune

  • Scenario: During business hours, System Center Configuration Manager (SCCM) or Microsoft Intune agents push software updates and patches to workstations. The deployment engine (ccmexec.exe or IntuneManagementExtension) often extracts installation files (MSI/EXE) to temporary folders (C:\Windows\CCMCache), triggering the rule when these extraction activities mimic the suspicious file creation logic defined in the YARA rule.
  • Filter/Exclusion: Exclude events where the process path contains ccmexec.exe, IntuneManagementExtension.exe, or the working directory is within known cache paths like %ProgramData%\Microsoft\Intune Management Extension.

• Automated Backup and Archiving Jobs

  • Scenario: Enterprise backup solutions such as Veeam Agent, Commvault, or Acronis Cyber Protect run nightly scheduled jobs to compress and archive data. These tools generate temporary files and execute compression routines that closely resemble the file manipulation patterns detected