kpot

Hunt Hypothesis

This detection targets adversaries leveraging the KPot malware framework to establish persistent command-and-control channels within Azure workloads using specific YARA signatures. Proactive hunting for this behavior is critical because early identification of these lightweight indicators allows the SOC team to isolate potential lateral movement before it escalates into a high-severity incident.

YARA Rule

rule kpot
{

    meta:
        author = " J from THL <[email protected]>"
        date = "2018-08-29"
        reference1 = "https://www.virustotal.com/#/file/4e87a0794bf73d06ac1ce4a37e33eb832ff4c89fb9e4266490c7cef9229d27a7/detection"
        reference2 = "ETPRO TROJAN KPOT Stealer Check-In [2832358]"
        reference3 = "ETPRO TROJAN KPOT Stealer Exfiltration [2832359]"
        version = 1
        maltype = "Stealer"
        filetype = "memory"

    strings:
        $text01 = "bot_id=%s"
        $text02 = "x64=%d"
        $text03 = "is_admin=%d"
        $text04 = "IL=%d"
        $text05 = "os_version=%d"
        $text06 = "IP: %S"
        $text07 = "MachineGuid: %s"
        $text08 = "CPU: %S (%d cores)"
        $text09 = "RAM: %S MB"
        $text10 = "Screen: %dx%d"
        $text11 = "PC: %s"
        $text12 = "User: %s"
        $text13 = "LT: %S (UTC+%d:%d)"
        $text14 = "%s/%s.php"
        $text15 = "Host: %s"
        $text16 = "username_value"
        $text17 = "password_value"
        $text18 = "name_on_card"
        $text19 = "last_four"
        $text20 = "exp_month"
        $text21 = "exp_year"
        $text22 = "bank_name"


    condition:
        16 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 22 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the kpot detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Scanning of Legacy Archives

  • Scenario: The on-premise antivirus engine (e.g., CrowdStrike Falcon or Carbon Black) performs a deep scan of a large, legacy .zip archive containing historical project files. The YARA rule triggers because the compressed file contains embedded scripts with signatures matching known KPot malware behaviors, even though the files are benign and quarantined by the AV engine.
  • Filter/Exclusion: Exclude processes belonging to the antivirus service (e.g., C:\Program Files\CrowdStrike\fsa.exe) when scanning file paths under D:\LegacyArchives\. Additionally, filter alerts where the parent process is identified as a known security scanner and the file hash matches a previously approved baseline.

• Scheduled Software Deployment via SCCM

  • Scenario: A nightly scheduled task managed by Microsoft Endpoint Configuration Manager (MECM/SCCM) deploys a critical Java runtime update to 500 workstations. The deployment agent extracts installation packages that include signed JAR files containing bytecode patterns similar to the KPot detection logic, triggering alerts during the extraction phase on the C:\Windows\CCMCache directory.
  • Filter/Exclusion: Create an exclusion for the SCCM service executable (ccmexec.exe) and its child processes when operating within the C:\Windows\CCMCache or C:\Program Files (x86)\Microsoft Configuration Manager directories. Whitelist file hashes for known deployment packages used in the last 30 days.

• IT Admin Manual Patching with PowerShell

  • Scenario: A System Administrator manually runs a custom PowerShell script (Update-ServerModules.ps1)