IndiaGolf

Hunt Hypothesis

This detection targets the specific execution patterns of the IndiaGolf malware family, which often utilizes legitimate Windows utilities to establish persistence and exfiltrate data from Azure-hosted workloads. Proactively hunting for this behavior in Azure Sentinel is critical because its low-severity classification may cause it to be overlooked during initial triage, allowing adversaries to maintain a stealthy foothold within the environment before escalating their activities.

YARA Rule

rule IndiaGolf
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - [email protected]"
		Source = "3dda69dfb254dcaea2ba6e8323d4b61ab1e130a0694f4c43d336cfb86a760c50"

	strings:
	/*
		FF D6        call    esi ; rand
		8B F8        mov     edi, eax
		C1 E7 10     shl     edi, 10h
		FF D6        call    esi ; rand
		03 F8        add     edi, eax
		89 7C 24 20  mov     [esp+2A90h+var_2A70], edi
		FF D6        call    esi ; rand
		8B F8        mov     edi, eax
		C1 E7 10     shl     edi, 10h
		FF D6        call    esi ; rand
		03 F8        add     edi, eax
		89 7C 24 24  mov     [esp+2A90h+var_2A6C], edi
	*/

	$generateRandomID = {FF ?? 8B ?? C1 ?? 10 FF ?? 03 F8 89 [3] FF ?? 8B ?? C1 ?? 10 FF ?? 03 ?? 89}

	condition:
		$generateRandomID in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the IndiaGolf detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Patch Deployment via SCCM/MECM

  • Context: The System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager deploys a critical security update to the C:\Windows\Temp directory. This process involves unpacking compressed archives containing executable payloads that match the IndiaGolf signature structure, specifically during the “Software Update” scheduled task run on Windows 10/11 endpoints.
  • Filter/Exclusion: Exclude processes originating from the ccmexec.exe (SCCM) parent process and restrict the rule to trigger only when the file path is outside of standard deployment directories like C:\Windows\CCMCache or C:\Program Files\Microsoft Configuration Manager.

• Scenario: Enterprise Antivirus Real-Time Scanning

  • Context: During a scheduled full-system scan, the enterprise endpoint protection agent (e.g., CrowdStrike Falcon, Symantec Endpoint Protection, or SentinelOne) extracts and analyzes archived files. The extraction engine creates temporary copies of legitimate business applications in C:\Users\Public\Documents which inadvertently trigger the IndiaGolf YARA pattern due to shared code libraries within the archive headers.
  • Filter/Exclusion: Create an exclusion for file paths matching the known antivirus installation directories (e.g., C:\ProgramData\CrowdStrike, C:\Program Files\Symantec) and exclude events where the parent process is the specific AV engine service (e.g., csagent.exe or rtvscan.exe).

• Scenario: IT Admin Manual Software Installation

  • Context: An IT administrator performs a manual installation of a new line-of-business application using an MSI installer. The installer