IndiaDelta

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of the IndiaDelta malware family, which often establishes persistence through specific file artifacts detectable by the associated YARA signature. Proactively hunting for this indicator in Azure Sentinel is critical to identify early-stage compromises and validate endpoint coverage before low-severity alerts escalate into broader lateral movement incidents.

YARA Rule

rule IndiaDelta
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - [email protected]"
		Source = "d7b50b1546653bff68220996190446bdc7fc4e38373715b8848d1fb44fe3f53c"

	strings:
	/*
		FF 15 DC 2D 41 00  call    ReadFile_0
		8B 44 24 20        mov     eax, [esp+25Ch+offsetInFile]
		8B 54 24 1C        mov     edx, [esp+25Ch+dwEmbedCnt]
		35 78 56 34 12     xor     eax, 12345678h
		55                 push    ebp
		55                 push    ebp
		81 F2 78 56 34 12  xor     edx, 12345678h
		50                 push    eax
		57                 push    edi
		89 54 24 2C        mov     [esp+26Ch+dwEmbedCnt], edx
		89 44 24 30        mov     [esp+26Ch+offsetInFile], eax
		FF 15 E0 2D 41 00  call    SetFilePointer_0
	*/

	$a =   {FF 15 [4-12] 3? 78 56 34 12 [0-2] 8? ?? 78 56 34 12 [0-10] FF 15}

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the IndiaDelta detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Scheduled Antivirus Definition Updates via WSUS

  • Context: The Windows Update Service (wuauserv) or a third-party agent like Microsoft Defender for Endpoint downloads and installs virus definition updates during the nightly maintenance window (e.g., 02:00 – 04:00 UTC). These updates often involve unpacking compressed archives containing executable payloads that match the IndiaDelta YARA signatures.
  • Filter/Exclusion: Exclude processes spawned by wuauclt.exe, MsMpEng.exe, or DefenderUpdateService running under the SYSTEM account during the defined maintenance window (02:00–04:00 UTC).

• Scenario: Enterprise Software Deployment via SCCM/Intune

  • Context: The Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune pushes a mandatory application update (e.g., Adobe Acrobat Reader or Java Runtime) to the workforce. The deployment agent extracts installation packages (msi or exe) into temporary directories (C:\Windows\CCMCache), triggering the rule on the extraction and execution of legitimate installer binaries.
  • Filter/Exclusion: Create an exclusion for file paths containing C:\Windows\CCMCache, C:\Program Files\Microsoft Intune Management Extension, or processes initiated by ccmexec.exe with a known digital signature from “Microsoft Corporation.”

• Scenario: Automated Backup and Archive Operations

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault perform daily incremental backups. These tools frequently scan, compress, and archive large datasets containing executable files (e