← Back to SOC feed Coverage →

Detects Trickbot Banking Trojan

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-30T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection rule identifies the presence of the Trickbot Banking Trojan, which adversaries deploy to steal financial credentials and establish persistent command-and-control channels within the network. Proactively hunting for this threat in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised endpoints before lateral movement occurs, thereby mitigating potential data exfiltration despite the rule’s current low severity classification.

YARA Rule

rule MALW_trickbot_bankBot : Trojan
{
meta:
 author = "Marc Salinas @Bondey_m"
 description = "Detects Trickbot Banking Trojan"
strings:
$str_trick_01 = "moduleconfig"
$str_trick_02 = "Start"
$str_trick_03 = "Control"
$str_trick_04 = "FreeBuffer"
$str_trick_05 = "Release"
condition:
all of ($str_trick_*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects Trickbot Banking Trojan rule in an enterprise environment, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_TrickBot.yar