Paradox

Hunt Hypothesis

This detection identifies anomalous binary behaviors matching the “Paradox” signature, which may indicate early-stage reconnaissance or the deployment of a novel, unsigned tool by an adversary within the environment. Proactively hunting for this pattern in Azure Sentinel is critical to validate false positives and uncover stealthy lateral movement tactics before they escalate into high-severity incidents.

YARA Rule

rule Paradox : RAT
{
	meta:
		author = " Kevin Breen <[email protected]>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Paradox"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "ParadoxRAT"
		$b = "Form1"
		$c = "StartRMCam"
		$d = "Flooders"
		$e = "SlowLaris"
		$f = "SHITEMID"
		$g = "set_Remote_Chat"

	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Paradox detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint

  • Scenario: The daily automated policy push from the MDE management console triggers a new executable or script hash on thousands of endpoints simultaneously. If the “Paradox” YARA rule scans for anomalous execution patterns in system directories, these mass updates may be flagged as suspicious because they involve rapid file creation and execution by the MsMpEng.exe service outside of standard business hours.
  • Filter/Exclusion: Create an exclusion based on the Parent Process Name (MsMpEng.exe) combined with a specific File Path pattern (e.g., C:\ProgramData\Microsoft\Windows Defender\*). Additionally, whitelist the specific SHA-256 hashes of known update installers published by Microsoft.

• Automated Patch Deployment via SCCM/MECM Scheduled Tasks

  • Scenario: A scheduled task running under the SYSTEM account executes a PowerShell script to deploy critical security patches using System Center Configuration Manager (SCCM). The “Paradox” rule might detect this as an anomaly if it looks for scripts executing from temporary directories (C:\Windows\CCMCache) or if the script performs network connections that mimic lateral movement behavior.
  • Filter/Exclusion: Exclude events where the User Account is NT AUTHORITY\SYSTEM and the Command Line contains specific SCCM identifiers (e.g., ccmsetup.exe, wsmprovhost.exe). You can also filter by the Scheduled Task Name, excluding tasks containing keywords like “SoftwareUpdate” or “PatchDeployment”.

• Log Aggregation and SIEM Forwarding via Splunk Universal Forwarder

  • Scenario: The Splunk Universal