Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux

Hunt Hypothesis

This hunt targets adversaries leveraging the Indetectables Remote Access Trojan (RAT) by monitoring for specific signature strings identified in recent research by Paul Rascagneres and Ronan Mouchoux. Proactively hunting for these indicators within Azure Sentinel is critical to identify early-stage, stealthy command-and-control communications that may evade standard heuristic detections due to their low-severity classification.

YARA Rule

rule Indetectables_RAT: RAT {
	meta:
		description = "Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux"
		author = "Florian Roth"
		reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
		date = "2015-10-01"
		super_rule = 1
		hash1 = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
		hash2 = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
		hash3 = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf96266772535f6801"
	strings:
		$s1 = "Coded By M3" fullword wide
		$s2 = "Stub Undetector M3" fullword wide
		$s3 = "www.webmenegatti.com.br" wide
		$s4 = "M3n3gatt1" fullword wide
		$s5 = "TheMisterFUD" fullword wide
		$s6 = "KillZoneKillZoneKill" fullword ascii
		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
		$s8 = "M3_F_U_D_M3" ascii
		$s9 = "M3n3gatt1hack3r" fullword wide
		$s9a = "M3n3gatt1hack3r" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 5000KB and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Indetectables RAT detection rule, tailored for an enterprise environment:

Scenario: Enterprise Endpoint Protection Scanning (CrowdStrike Falcon or SentinelOne)
- Context: During routine real-time scanning or on-demand deep scans, endpoint protection agents often load dynamic libraries and execute internal modules that contain signature strings identical to those identified in the Rascagneres & Mouchoux research. The scanner’s process may inject code into user sessions, triggering the string-based detection logic.
- Suggested Filter/Exclusion: Exclude processes where ParentProcessName matches known EDR agents (e.g., Cortex.exe, SentinelOneAgent.exe) and the CommandLine contains arguments related to “scan,” “update,” or “signature-check.”
Scenario: Microsoft Office Macro Execution via Scheduled Maintenance
- Context: IT administrators frequently deploy scheduled jobs using PowerShell scripts that invoke Excel or Word instances (EXCEL.EXE, WINWORD.EXE) to process large datasets. These applications, when loading specific add-ins or processing VBA macros with embedded security libraries, may generate memory strings matching the RAT indicators, particularly if the enterprise uses a standardized template library.
- Suggested Filter/Exclusion: Create an exclusion rule for ProcessName equal to EXCEL.EXE or WINWORD.EXE where the UserAccount is a service account (e.g., svc-data-processor) and the execution occurs during defined maintenance windows (e.g., 02:00–04:00 local time).
Scenario: Software Deployment via SCCM or Intune
- Context: During mass software deployments, Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager agents execute installation packages that include self-extracting archives. These installers often