Nettravelr

Hunt Hypothesis

The Nettravelr rule detects potential lateral movement by identifying suspicious network traffic patterns that may indicate an adversary using a network travel technique to move within a network. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and contain early-stage threats before they escalate.

YARA Rule

rule NetTraveler : Family {
	meta:
		description = "Nettravelr"
		author = "Katie Kleemola"
		last_updated = "2014-07-08"
	
	condition:
		NetTravExports or NetTravStrings or NetpassStrings

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Scenario: Scheduled System Backup Using Veeam Backup & Replication
  Filter/Exclusion: Exclude traffic originating from the Veeam backup server IP or any known backup-related processes (e.g., veeam.exe, vbr.exe).

• Scenario: Admin Performing Remote Desktop Protocol (RDP) Session from a Trusted IP
  Filter/Exclusion: Exclude RDP sessions from known trusted internal IPs or users with administrative privileges (e.g., using user field or src_ip in the rule).

• Scenario: Patch Management Task Using Microsoft System Center Configuration Manager (SCCM)
  Filter/Exclusion: Exclude traffic associated with SCCM patching tasks (e.g., smsprov.exe, ccmexec.exe) or from the SCCM server IP.

• Scenario: Log Collection via Splunk Forwarder to a Centralized Log Server
  Filter/Exclusion: Exclude traffic from Splunk forwarders (e.g., splunkforwarder.exe) or from the Splunk index server IP.

• Scenario: Database Replication Between Primary and Secondary SQL Servers
  Filter/Exclusion: Exclude traffic between SQL servers involved in replication (e.g., sqlservr.exe) or use a specific dest_ip or src_ip filter for known replication pairs.