LightweightBackdoor2

Hunt Hypothesis

This hypothesis posits that adversaries are deploying lightweight backdoors to establish persistent footholds with minimal resource consumption and network visibility. The SOC team should proactively hunt for this behavior in Azure Sentinel to identify early-stage compromise indicators before they escalate into significant data exfiltration or lateral movement events.

YARA Rule

rule LightweightBackdoor2
{
	strings:
		$STR1 = "prxTroy" ascii wide nocase
	
	condition:
		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the LightweightBackdoor2 detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Antivirus Real-Time Scanning

  • Scenario: The YARA rule detects a legitimate memory injection or process hollowing technique used by CrowdStrike Falcon or SentinelOne during real-time scanning. These EDR agents frequently inject code into explorer.exe or svchost.exe to analyze file access, which mimics the behavior of a lightweight backdoor establishing persistence.
  • Filter/Exclusion: Create an exclusion for processes where the parent process is the specific EDR service (e.g., CrowdStrike Falcon Sensor, SentinelOne Agent) and the image path matches the known installation directory (e.g., C:\Program Files\CrowdStrike\*).

• Scheduled PowerShell Maintenance Scripts

  • Scenario: A nightly scheduled task runs a custom PowerShell script (powershell.exe -NoProfile -ExecutionPolicy Bypass) to patch configurations or update software. The script dynamically loads modules and executes remote commands, triggering the backdoor logic due to the creation of temporary child processes and network connections from powershell.exe initiated by Task Scheduler.
  • Filter/Exclusion: Exclude events where the process name is powershell.exe, the parent process is svchost.exe (specifically the “Schedule” service), and the command line argument contains a known internal script path (e.g., \\fileserver\scripts\maintenance\daily_patch.ps1).

• Software Deployment via SCCM/Intune

  • Scenario: During business hours, Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune pushes a software update. The deployment engine (ccmexec.exe or `Device