DarkComet

Hunt Hypothesis

This detection rule identifies potential post-exploitation command-and-control activities associated with the DarkComet malware, which often establishes persistent connections to exfiltrate sensitive data from Azure workloads. Proactively hunting for these specific behavioral patterns in Azure Sentinel is critical because early identification of DarkComet’s low-severity indicators can prevent lateral movement and mitigate data loss before more severe impacts occur.

YARA Rule

rule DarkComet_2 : rat
{
	meta:
		description = "DarkComet" 
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2013-01-12"
		filetype = "memory"
		version = "1.0" 

	strings:
		$a = "#BEGIN DARKCOMET DATA --"
		$b = "#EOF DARKCOMET DATA --"
		$c = "DC_MUTEX-"
		$k1 = "#KCMDDC5#-890"
		$k2 = "#KCMDDC51#-890"

	condition:
		any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the DarkComet detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Management Agent Updates

  • Scenario: The DarkComet rule may trigger when enterprise endpoint management tools (e.g., Microsoft Intune, Ivanti Endpoint Manager, or Tanium) push scheduled software updates or policy changes to thousands of workstations. These agents often execute background scripts that modify system files and registry keys in a manner identical to the initial infection behavior of DarkComet.
  • Filter/Exclusion: Exclude processes originating from known management console binaries (e.g., IntuneManagementExtension.exe, TaniumClientService.exe) running under the SYSTEM or dedicated service accounts (DOMAIN\svc-intune). Additionally, filter alerts where the execution path matches the standard installation directory of these tools.

• Scheduled Antivirus Scans and Remediation

  • Scenario: During off-hours maintenance windows, enterprise antivirus solutions (such as CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection) perform deep system scans. When these engines detect a benign file anomaly or execute a remediation script to quarantine a false threat, they may spawn child processes and write temporary files that mimic the “dropper” activity detected by DarkComet.
  • Filter/Exclusion: Create an exclusion for parent-child process relationships where the parent is a known AV engine (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe) and the action occurs during defined maintenance windows (e.g., 02:00 – 04:00 local time).

• IT Admin PowerShell Automation Scripts

  • Scenario: System administrators frequently run complex PowerShell scripts to manage user provisioning, patch compliance checks, or group policy updates