genericSMS2

Hunt Hypothesis

The genericSMS2 rule detects potential adversary behavior involving the use of SMS-based communication for command and control or exfiltration, which may indicate a low-severity threat leveraging mobile networks. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage threats that could escalate into more severe attacks.

YARA Rule

rule genericSMS2 : smsFraud android
{
	meta:
		author = "https://twitter.com/plutec_net"
                reference = "https://koodous.com/"
		sample = "1f23524e32c12c56be0c9a25c69ab7dc21501169c57f8d6a95c051397263cf9f"
		sample2 = "2cf073bd8de8aad6cc0d6ad5c98e1ba458bd0910b043a69a25aabdc2728ea2bd"
		sample3 = "20575a3e5e97bcfbf2c3c1d905d967e91a00d69758eb15588bdafacb4c854cba"

	strings:
		$a = "NotLeftTriangleEqual=022EC"
		$b = "SHA1-Digest: X27Zpw9c6eyXvEFuZfCL2LmumtI="
		$c = "_ZNSt12_Vector_baseISsSaISsEE13_M_deallocateEPSsj"
		$d = "FBTP2AHR3WKC6LEYON7D5GZXVISMJ4QU"

	condition:
		all of them
		
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://koodous.com/
• Source Rule

False Positive Guidance

• Scenario: System Maintenance Script Execution
  Description: A legitimate system maintenance script (e.g., schtasks.exe or task scheduler) is running a scheduled job that includes SMS-related commands or files.
  Filter/Exclusion: Exclude processes initiated by schtasks.exe or Task Scheduler with known legitimate job names (e.g., CleanupJob, DiskDefrag).

• Scenario: Security Software Update
  Description: A security tool (e.g., Microsoft Defender, CrowdStrike, or CrowdStrike Falcon) is updating its signature database, which includes SMS-related files.
  Filter/Exclusion: Exclude processes from known security vendors (e.g., MsMpEng.exe, CrowdStrikeAgent.exe) or files signed by trusted security vendors.

• Scenario: Admin Task for SMS Configuration
  Description: An administrator is configuring SMS (Simple Mail Transfer) settings via the command line or PowerShell (e.g., smtp.exe, sendmail.exe).
  Filter/Exclusion: Exclude processes initiated by powershell.exe or cmd.exe with known admin tasks (e.g., Configure-SMS, Set-SMTPServer).

• Scenario: Log File Analysis
  Description: A log analysis tool (e.g., logparser.exe, Splunk, or ELK Stack) is parsing SMS-related log files for troubleshooting.
  Filter/Exclusion: Exclude processes associated with log analysis tools or files with known log extensions (e.g., .log, .csv, .txt).

• Scenario: Email Server Maintenance
  Description: An email server (e.g., Microsoft Exchange, Postfix, or Sendmail) is performing routine maintenance or sending test emails.
  Filter/Exclusion: Exclude processes from known email servers (e.g., msexchange.exe, postfix,