LightweightBackdoor4

Hunt Hypothesis

This detection identifies the execution of a lightweight backdoor payload designed to establish persistent access while evading traditional signature-based defenses through minimal resource consumption. Proactive hunting for this behavior in Azure Sentinel is critical to uncover stealthy initial footholds that may otherwise remain undetected due to their low severity and subtle operational footprint.

YARA Rule

rule LightweightBackdoor4
{
	strings:	
		$strl  = { C6 45 F4 61 C6 45 F5 6E C6 45 F6 73 C6 45 F7 69 C6 45 F8 2E C6 45 F9 6E C6 45 FA 6C C6 45 FB 73 } // 'ansi.nls' being moved to ebp
	
	condition:
		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the LightweightBackdoor4 detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Endpoint Patching by SCCM/MECM

  • Context: The System Center Configuration Manager (SCCM) client service (ccmexec.exe) frequently spawns temporary worker processes to download and install OS updates. These workers often inject code into explorer.exe or create lightweight helper executables in the %TEMP% directory that mimic backdoor behavior by establishing outbound connections to Microsoft update servers.
  • Filter/Exclusion: Exclude file paths containing \Program Files\Microsoft Configuration Manager\ and parent processes named ccmexec.exe. Additionally, whitelist network destinations matching the Microsoft Update CDN IP ranges (e.g., *.update.microsoft.com).

• Scenario: Scheduled Antivirus Deep Scan Tasks

  • Context: During off-hours, enterprise antivirus solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint launch deep scanning tasks. These tasks often spawn lightweight scanner binaries (e.g., MsMpEng.exe spawning mpcmdrun.exe) that perform memory introspection and file system enumeration, which can trigger the YARA rule’s signature for “suspicious process injection” or “unusual memory mapping.”
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 02:00–04:00 UTC) for processes originating from known AV vendors. Specifically, exclude file hashes associated with the Antimalware Service Executable and its child processes when they are running under the scheduled task \Microsoft\Windows Defender\MpCmdRun.

• Scenario: Developer CI/CD Pipeline Agents

  • Context: In development environments, Jenkins or GitLab Runner agents execute build scripts