Identifies Maze ransomware in memory or unpacked.

Hunt Hypothesis

This hunt hypothesis posits that adversaries are actively deploying Maze ransomware within our Azure environment by executing its payload directly in memory to evade traditional file-based detection. Proactively hunting for this behavior is critical because early identification of these unpacked or in-memory instances allows the SOC team to isolate affected assets before encryption begins, significantly reducing potential downtime and data loss.

YARA Rule

rule Maze
{
meta:
	description = "Identifies Maze ransomware in memory or unpacked."
	author = "@bartblaze"
	date = "2019-11"
	tlp = "White"

strings:	
	$ = "Enc: %s" ascii wide
	$ = "Encrypting whole system" ascii wide
	$ = "Encrypting specified folder in --path parameter..." ascii wide
	$ = "!Finished in %d ms!" ascii wide
	$ = "--logging" ascii wide
	$ = "--nomutex" ascii wide
	$ = "--noshares" ascii wide
	$ = "--path" ascii wide
	$ = "Logging enabled | Maze" ascii wide
	$ = "NO SHARES | " ascii wide
	$ = "NO MUTEX | " ascii wide
	$ = "Encrypting:" ascii wide
	$ = "You need to buy decryptor in order to restore the files." ascii wide
	$ = "Dear %s, your files have been encrypted by RSA-2048 and ChaCha algorithms" ascii wide
	$ = "%s! Alert! %s! Alert! Dear %s Your files have been encrypted by %s! Attention! %s" ascii wide
	$ = "DECRYPT-FILES.txt" ascii wide fullword

condition:
	5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Maze Ransomware detection rule, including suggested filters and exclusions:

• Antivirus Real-Time Scanning of Large Archives

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or SentinelOne perform deep inspection on large .zip or .tar.gz files containing application installers. During this process, the AV engine unpacks these archives into memory to scan for embedded threats, triggering a “Maze in memory” alert due to the presence of legitimate decompression libraries that share signature characteristics with Maze’s unpacking behavior.
  • Filter/Exclusion: Exclude processes spawned by known EDR agents (e.g., falcon.sys, sentinel-agent.exe) when they are accessing files in standard software distribution directories (e.g., C:\Program Files\Installers or D:\SoftwareRepo).

• Scheduled Backup Agent Operations

  • Scenario: A scheduled backup job using Veeam Backup & Replication or Commvault runs during off-hours. The agent extracts and verifies large database dumps (.bak, .sql) in memory before encrypting them for the cloud repository. This unpacking activity mimics the initial staging phase of Maze ransomware, causing a false trigger on the backup service account.
  • Filter/Exclusion: Create an exclusion rule for the specific Service Accounts used by backup software (e.g., DOMAIN\VeeamSvc, DOMAIN\CommvaultAgent) and restrict the alert to exclude file paths located within dedicated backup staging folders (e.g., C:\VeeamStaging or \\BackupServer\Temp).

• Software Deployment via Configuration Management

  • Scenario: An automated deployment task using Microsoft SCCM (Configuration Manager) or **Ans