Greame

Hunt Hypothesis

This detection targets adversary behavior involving the execution of the Greame malware family, which often establishes persistence through scheduled tasks and network communication to command-and-control servers. The SOC team should proactively hunt for this activity in Azure Sentinel because early identification of Greame’s low-severity indicators allows analysts to correlate with lateral movement patterns before the threat escalates into a critical incident.

YARA Rule

rule Greame : RAT
{
	meta:
		author = " Kevin Breen <[email protected]>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Greame"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		
	strings:
    		$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
            $b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
            $c = "EditSvr"
            $d = "TLoader"
			$e = "Stroks"
            $f = "Avenger by NhT"
			$g = "####@####"
			$h = "GREAME"
			
    condition:
    		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Greame detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Engine Updates

  • Scenario: The CrowdStrike Falcon sensor performs a scheduled daily update of its host protection module. This process involves writing new signature files to the C:\ProgramData\ CrowdStrike directory and executing the falcon-sensor.exe binary, which mimics Greame’s behavior of dropping executable payloads into system directories.
  • Suggested Filter: Exclude events where the parent process is falcon-sensor.exe (PID 1234) and the file path contains \CrowdStrike\.

• Microsoft SCCM Application Deployment

  • Scenario: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) deploys a critical security patch to workstations. During this task, it extracts a temporary installer package into the %TEMP% folder and executes a silent installation command, triggering file creation and execution patterns that match the Greame YARA logic.
  • Suggested Filter: Create an exclusion for processes spawned by ccmexec.exe where the destination path starts with C:\Windows\CCMCache\.

• Automated PowerShell Compliance Reporting

  • Scenario: A scheduled Task Scheduler job runs every Monday at 08:00 AM to generate compliance reports. The task executes a custom script (ComplianceCheck.ps1) located in C:\Scripts\, which dynamically generates temporary configuration files and invokes the powershell.exe interpreter with specific arguments, resembling Greame’s script execution signature.
  • Suggested Filter: Exclude events where the command line contains -ExecutionPolicy Bypass and the working directory is C:\Scripts\Compliance, specifically for the