LimaCharlie

Hunt Hypothesis

This detection targets adversary behavior involving the execution of suspicious binaries or scripts identified by the LimaCharlie YARA signature, which often indicates early-stage reconnaissance or lateral movement activities. Proactively hunting for these indicators in Azure Sentinel is critical to validate potential threats before they escalate, ensuring that low-severity alerts are correlated with broader attack patterns rather than dismissed as noise.

YARA Rule

rule LimaCharlie
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - [email protected]"
		Source_x86 = "6ee6ae79ee1502a11ece81e971a54f189a271be9ec700101a2bd7a21198b94c7"
		Source_x64 = "90ace24eb132c776a6d5bb0451437db21e84601495a2165d75f520af637e71e8"

	strings:
		$misspelling = "Defualt Sleep = %d" wide

	/*
		FF 76 74           push    dword ptr [esi+74h]
		59                 pop     ecx
		50                 push    eax
		8F 86 48 01 00 00  pop     dword ptr [esi+148h]
		85 C0              test    eax, eax
		51                 push    ecx
		8F 86 44 01 00 00  pop     dword ptr [esi+144h]
		75 3D              jnz     short loc_100035F3
		F6 46 56 01        test    byte ptr [esi+56h], 1
		74 0A              jz      short loc_100035C6
	*/

	$x86 = {FF ?? 74 5? 5? 8F ?? 48 01 00 00 85 C0 5? 8F ?? 44 01 00 00 75 ?? F6 [2] 01 74}

	/*
		48 8B 4B 70           mov     rcx, [rbx+70h]
		48 89 8B 60 01 00 00  mov     [rbx+160h], rcx
		48 89 83 68 01 00 00  mov     [rbx+168h], rax
		48 85 C0              test    rax, rax
		75 35                 jnz     short loc_180002372
		F6 43 56 01           test    byte ptr [rbx+56h], 1
		74 07                 jz      short loc_18000234A
	*/

	$x64 = {48 [2] 70 48 [2] 60 01 00 00 48 [2] 68 01 00 00 48 85 C0 75 ?? F6 [2] 01 74}
		
	condition:
		$x86 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
		or $x64 in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
		or $misspelling
		
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the LimaCharlie detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Policy Updates via CrowdStrike Falcon

  • Scenario: The CrowdStrike Falcon sensor performs a scheduled “Policy Push” or “Definition Update” every morning at 02:00 UTC. This process involves the csagent.exe service writing new configuration files and dropping updated YARA signatures into the %ProgramData%\CrowdStrike\ directory, which mimics the behavior of a legitimate file creation/execution event often flagged by LimaCharlie’s baseline deviation logic.
  • Suggested Filter: Exclude file paths containing C:\ProgramData\CrowdStrike\* and exclude process names matching csagent.exe or falcon-sensor.exe when executed from the System user context during maintenance windows (01:00–04:00 UTC).

• Microsoft 365 Defender Antimalware Scans

  • Scenario: During business hours, the Microsoft Defender for Endpoint service (MsMpEng.exe) executes a “Quick Scan” on user workstations. This triggers the creation of temporary quarantine files and log entries in C:\ProgramData\Microsoft\Windows Defender\Scans\ directory. If the YARA rule is sensitive to rapid file creation or specific hash patterns associated with scan logs, it may flag these routine operations as anomalous activity.
  • Suggested Filter: Create an exclusion for processes named MsMpEng.exe and MpCmdRun.exe, specifically targeting file paths under C:\ProgramData\Microsoft\Windows Defender\*. Additionally, filter out events where the parent process is svchost.exe with the service name WdNisSvc.

• Scheduled Group Policy Preferences (GPP) Deployment