detect Noderat in memory

Hunt Hypothesis

This hunt targets adversaries executing the Noderat cryptocurrency miner within system memory to evade traditional disk-based detection and consume host resources. Proactively hunting for this behavior in Azure Sentinel is critical because early identification of these stealthy processes prevents prolonged resource degradation and potential lateral movement before they escalate into high-severity incidents.

YARA Rule

rule Noderat {
          meta:
            description = "detect Noderat in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html"

          strings:
            $config = "/config/app.json"
            $key = "/config/.regeditKey.rc"
            $message = "uninstall error when readFileSync: "

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the detect Noderat in memory rule within an enterprise environment, including suggested filters and exclusions:

Scheduled Antivirus Scans with Heuristic Engines
- Scenario: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint perform scheduled deep memory scans. These tools often inject their own scanning modules into the address space of critical system processes to analyze running code, which can mimic the in-memory footprint of a Noderat infection due to similar API call patterns and memory allocation behaviors.
- Filter/Exclusion: Create an exclusion for known EDR service executables (e.g., C:\Program Files\CrowdStrike\fsas.exe, MsMpEng.exe) and whitelist the specific process IDs (PIDs) associated with scheduled scan jobs defined in the Group Policy or agent configuration.
CI/CD Pipeline Build Agents on Hosted Runners
- Scenario: In DevOps environments, hosted build runners (such as GitHub Actions Self-Hosted Runners, Jenkins Agents, or Azure DevOps MSBuild agents) frequently load large .NET assemblies and dynamic libraries into memory during the compilation of Node.js applications. The rapid loading and unloading of these modules can trigger the detection logic if the rule interprets the high-frequency memory injection as a Noderat persistence mechanism.
- Filter/Exclusion: Exclude network segments or host groups designated for CI/CD infrastructure (e.g., OU=DevOps_Builders) and filter out processes spawned by known build orchestrators like java.exe (Jenkins), node.exe running under the System account, or specific container runtimes (containerd, dockerd).
Enterprise Software Updates via Management Consoles