IndiaCharlie Two

Hunt Hypothesis

This detection targets adversary behavior associated with the IndiaCharlie threat actor by identifying specific file artifacts defined in the IndiaCharlie_Two YARA signature within Azure Sentinel logs. Proactively hunting for this low-severity indicator is essential to establish a baseline of known benign activity and ensure early visibility into potential reconnaissance or initial access attempts before they escalate into higher-impact incidents.

YARA Rule

rule IndiaCharlie_Two
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - [email protected]"

	strings:
		$s1 = "%s is an essential element in Windows System configuration and management. %s"
		$s2 = "%SYSTEMROOT%\\system32\\svchost.exe -k "
		$s3 = "%s\\system32\\%s"
		$s4 = "\\mspaint.exe"
		$s5 = ":R\nIF NOT EXIST %s GOTO E\ndel /a %s\nGOTO R\n:E\ndel /a d.bat"
		$aesKey = "}[eLkQAeEae0t@h18g!)3x-RvE%+^`n.6^()?+00ME6a&F7vcV}`@.dj]&u$o*vX"

	condition:
		3 of ($s*) or $aesKey
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the IndiaCharlie Two detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint

  • Scenario: The daily automated policy push from the MDE management server triggers the execution of a new definition update package. This process often involves creating temporary files with similar naming conventions to IndiaCharlie artifacts in the %TEMP% directory and initiating background processes (MsMpEng.exe) that load specific DLLs known to match the rule’s signature logic.
  • Filter/Exclusion: Exclude file paths containing \Program Files\Microsoft Defender Antivirus\ and process names MsMpEng.exe or SenseAgent.exe when executed by the SYSTEM account. Additionally, filter out events where the parent process is TaskScheduler running a scheduled job named “Defender Update”.

• Software Deployment via SCCM (System Center Configuration Manager)

  • Scenario: During business hours, the SCCM client (ccmexec.exe) deploys a critical security patch or application update to workstations. The deployment agent extracts installation packages into temporary folders and launches installers that dynamically load shared libraries. These libraries often contain code blocks identical to those flagged by IndiaCharlie Two, specifically during the “Application” phase of the deployment lifecycle.
  • Filter/Exclusion: Create an exclusion for any process tree where the parent process is ccmexec.exe or SMSHostCtrl.exe. Furthermore, exclude file hashes that match the known SCCM client package repository hash list (maintained in a centralized allowlist) to prevent recurring alerts on standard deployment artifacts.

• Automated Log Rotation and Archiving by Splunk Universal Forwarder

  • Scenario: The nightly scheduled job managed by Windows Task Scheduler triggers the Splunk Universal Forwarder (splunkd.exe)