detect Lokibot in memory

Hunt Hypothesis

This detection rule identifies the presence of Lokibot malware within system memory, signaling potential lateral movement or data exfiltration activities by an adversary. Proactively hunting for this behavior in Azure Sentinel is critical to validate initial alerts and uncover dormant threats that may have evaded standard signature-based defenses.

YARA Rule

rule Lokibot {
          meta:
            description = "detect Lokibot in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"
            hash1 = "6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c"

          strings:
            $des3 = { 68 03 66 00 00 }
            $param = "MAC=%02X%02X%02XINSTALL=%08X%08X"
            $string = { 2d 00 75 00 00 00 46 75 63 6b 61 76 2e 72 75 00 00}

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “detect Lokibot in memory” rule within an enterprise environment, along with suggested filters or exclusions:

• Scheduled Backup and Snapshot Jobs

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault often spawn a lokibot (or similar agent) process to perform memory snapshots of virtual machines during off-hours. These processes load the bot into memory to capture state before terminating, triggering the detection without malicious intent.
  • Filter/Exclusion: Create an exclusion for the parent process name matching known backup services (e.g., vbrservice.exe, simagent.exe) and restrict the alert time window to business off-hours (e.g., 02:00 – 06:00 local time).

• Endpoint Security Agent Updates

  • Scenario: During a scheduled patch cycle, endpoint protection suites such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint may download and stage the Lokibot component in memory to verify integrity before installation. This often occurs when the agent service (CfSvc.exe, S1Service.exe) initiates a self-update routine.
  • Filter/Exclusion: Exclude events where the parent process is identified as the primary security agent service and the file path of the Lokibot binary resides within the vendor’s trusted installation directory (e.g., C:\Program Files\CrowdStrike\ or %ProgramFiles%\Microsoft Defender Antivirus\).

• CI/CD Pipeline Execution on Build Agents

  • Scenario: In DevOps environments, build servers running Jenkins, GitLab Runners, or Azure DevOps Agents frequently execute containerized pipelines that include the Lokibot tool for code quality scanning or secret detection.