Generic detection for Vulcan branch Rebirth or Katrina from Torlus nextgen

Hunt Hypothesis

This hunt targets potential early-stage reconnaissance or lateral movement activities associated with the Vulcan branch Rebirth and Katrina campaigns from the Torlus NextGen threat actor group. Proactively searching for these specific indicators in Azure Sentinel is critical to identify subtle, low-severity footholds before they escalate into more significant compromises within the organization’s cloud infrastructure.

YARA Rule

rule is__str_Rebirth_gen3 {
	meta:
		description = "Generic detection for Vulcan branch Rebirth or Katrina from Torlus nextgen"
		reference = "https://imgur.com/a/SSKmu"
		reference = "https://www.reddit.com/r/LinuxMalware/comments/7rprnx/vulcan_aka_linuxrebirth_or_katrina_variant_of/"
		author = "unixfreaxjp"
		org = "MalwareMustDie"
		date = "2018-01-21"
	strings:
        	$str01 = "/usr/bin/python" fullword nocase wide ascii
        	$str02 = "nameserver 8.8.8.8\nnameserver 8.8.4.4\n" fullword nocase wide ascii
        	$str03 = "Telnet Range %d->%d" fullword nocase wide ascii
        	$str04 = "Mirai Range %d->%d" fullword nocase wide ascii
        	$str05 = "[Updating] [%s:%s]" fullword nocase wide ascii
        	$str06 = "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*" fullword nocase wide ascii
		$str07 = "\x1B[96m[DEVICE] \x1B[97mConnected" fullword nocase wide ascii
	condition:
        	4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• https://www.reddit.com/r/LinuxMalware/comments/7rprnx/vulcan_aka_linuxrebirth_or_katrina_variant_of/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Generic detection for Vulcan branch Rebirth or Katrina from Torlus nextgen rule, tailored for an enterprise environment:

• Scheduled Vulnerability Scanning by Qualys Cloud Agent

  • Scenario: The nightly vulnerability scan job executed by the Qualys Cloud Agent on the “Torus-NextGen” subnet initiates a connection to the Vulcan Rebirth branch repository. This legitimate traffic involves the agent pulling updated configuration manifests and security patches, which mimics the signature of the “Rebirth” or “Katrina” activity defined in the rule.
  • Suggested Filter/Exclusion: Create an exclusion for source IP ranges belonging to the Qualys management servers (e.g., 10.20.50.x) and restrict the alert trigger to only occur outside of the scheduled maintenance window (02:00–04:00 UTC).

• Automated Deployment via Jenkins CI/CD Pipeline

  • Scenario: A routine deployment job within the Jenkins pipeline triggers a build process that pulls dependencies from the Torlus NextGen artifact repository. The “Rebirth” branch is frequently accessed during these builds to validate code integrity, generating high-volume traffic that matches the detection logic for legitimate application updates rather than anomalous behavior.
  • Suggested Filter/Exclusion: Exclude traffic originating from the internal Jenkins controller IP (192.168.10.5) and filter by HTTP User-Agent strings containing Jenkins/2.x or specific build job names (e.g., torlus-nextgen-deploy-job).

• Administrative Configuration Sync via Microsoft SCCM

  • Scenario: The Microsoft System Center Configuration Manager (SCCM) performs a scheduled configuration synchronization task. During this window, the SCCM site server communicates with the Vulcan