← Back to SOC feed Coverage →

detect Himawari(a variant of RedLeaves) in memory

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-02T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt targets the presence of the Himawari malware (a RedLeaves variant) within system memory to identify early-stage reconnaissance or lateral movement activities often missed by signature-based defenses. Proactively hunting for this behavior in Azure Sentinel is critical because Himawari’s low-severity, fileless nature requires deep memory inspection to prevent silent persistence and potential data exfiltration before it escalates into a high-impact incident.

YARA Rule

rule Himawari {
          meta:
            description = "detect Himawari(a variant of RedLeaves) in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "https://www.jpcert.or.jp/present/2018/JSAC2018_01_nakatsuru.pdf"
            hash1 = "3938436ab73dcd10c495354546265d5498013a6d17d9c4f842507be26ea8fafb"

          strings:
            $h1 = "himawariA"
            $h2 = "himawariB"
            $h3 = "HimawariDemo"

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Himawari (RedLeaves) detection rule, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MalConfScan.yar