Rule to hit on the XORed DoublePulsar DLL injection shellcode

Hunt Hypothesis

This hunt targets adversaries leveraging the DoublePulsar exploit to inject obfuscated shellcode via XOR encryption, a technique designed to evade signature-based detection during lateral movement and persistence phases. Proactively hunting for this specific pattern in Azure Sentinel is critical because it identifies early-stage exploitation of SMB vulnerabilities that often precede large-scale ransomware campaigns or advanced persistent threats within the environment.

YARA Rule

rule DoublePulsarDllInjection_Petya
{
 meta:
  description = "Rule to hit on the XORed DoublePulsar DLL injection shellcode"
  author = "Patrick Jones"
  company = "Booz Allen Hamilton"
  reference1 ="https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html"
  reference2 = "https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf"
  date = "2017-06-28"
  hash = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
  hash = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1" 
 strings:
   $DoublePulsarDllInjection_Petya = { 45 20 8D 93 8D 92 8D 91 8D 90 92 93 91 97 0F 9F 9E 9D 99 84 45 29 84 4D 20 CC CD CC CC 9B 84 45 03 84 45 14 84 45 49 CC 33 33 33 24 77 CC CC CC 84 45 49 C4 33 33 33 24 84 CD CC CC 84 45 49 DC 33 33 33 84 47 49 CC 33 33 33 84 47 41 }
 condition:
   $DoublePulsarDllInjection_Petya
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the XORed DoublePulsar DLL injection shellcode detection rule, including suggested filters and exclusions:

• Endpoint Protection Scanning via CrowdStrike Falcon or Microsoft Defender

  • Scenario: During routine real-time scanning or on-demand full system scans, EDR agents often inject shellcode into memory to analyze running processes. The specific XOR-decoded payload used by these vendors for their internal DLL injection mechanisms can structurally resemble the DoublePulsar signature, particularly when the agent updates its kernel drivers.
  • Filter/Exclusion: Create an exclusion based on the Parent Process Name and Process ID. Exclude events where the parent process is CrowdStrike Falcon Sensor (CSFalconService.exe) or Microsoft Defender Antivirus Service (MsMpEng.exe). Additionally, filter by the specific User Account running these services (e.g., NT AUTHORITY\SYSTEM).

• Patch Management Deployment via SCCM or Ivanti

  • Scenario: When deploying critical security patches or software updates during maintenance windows, tools like Microsoft Endpoint Configuration Manager (SCCM) or Ivanti utilize custom shellcode to inject DLLs into target sessions. This often occurs when the deployment agent performs a “silent install” that requires memory manipulation on the client side, triggering the XORed signature.
  • Filter/Exclusion: Implement a time-based filter combined with Process Path. Exclude events occurring between 02:00 and 06:00 (standard maintenance window) where the initiating process path contains \Microsoft SCCM\ or \Ivanti\. You may also exclude specific Hash values of the legitimate deployment agents if they remain constant across the fleet.

• Scheduled Backup Operations using Veeam or Commvault

  • Scenario: Enterprise backup solutions frequently inject DLLs