Phoenix Exploit Kit Detection

Hunt Hypothesis

The Phoenix Exploit Kit Detection identifies potential exploitation attempts by malicious actors leveraging compromised legitimate credentials to execute arbitrary code within an Azure environment. SOC teams should proactively hunt for this behavior to detect and mitigate early-stage compromise attempts that could lead to persistent, stealthy malware deployment.

YARA Rule

rule phoenix_jar3 : EK Jar
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Phoenix Exploit Kit Detection"
   hash0 = "c5655c496949f8071e41ea9ac011cab2"
   sample_filetype = "unknown"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "'> >$>"
   $string1 = "bpac/PK"
   $string2 = "bpac/purok$1.classmP]K"
   $string3 = "bpac/KAVS.classmQ"
   $string4 = "'n n$n"
   $string5 = "bpac/purok$1.classPK"
   $string6 = "$.4aX,Gt<"
   $string7 = "bpac/KAVS.classPK"
   $string8 = "bpac/b.classPK"
   $string9 = "bpac/b.class"
condition:
   9 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Scheduled System Maintenance Job
  Description: A legitimate system maintenance job (e.g., schtasks.exe or task scheduler) is running a script that includes a command resembling exploit kit behavior.
  Filter/Exclusion: Exclude processes initiated by the Task Scheduler service (svchost.exe -s schedule) or filter by the job name in the command line.

• Scenario: Admin Performing PowerShell Script Debugging
  Description: An administrator is using PowerShell (powershell.exe) to debug or test a script that includes obfuscated commands similar to those used by the Phoenix Exploit Kit.
  Filter/Exclusion: Exclude processes launched with the -Command parameter in PowerShell or filter by user accounts with administrative privileges (e.g., Administrator or Domain Admins).

• Scenario: Antivirus or EDR Tool Performing a Scan
  Description: A security tool like Microsoft Defender or CrowdStrike Falcon is executing a scan that temporarily uses a command pattern matching the Phoenix Exploit Kit.
  Filter/Exclusion: Exclude processes associated with known security tools (e.g., MsMpEng.exe, falcon.exe) or filter by the process name and parent process.

• Scenario: Database Backup or Restore Operation
  Description: A database backup or restore operation (e.g., using sqlcmd.exe or mysqldump) includes a command that matches the detection logic due to similar syntax.
  Filter/Exclusion: Exclude processes initiated by database services (e.g., sqlservr.exe, mysqld) or filter by command-line arguments related to backup/restore operations.

• Scenario: Network Monitoring Tool Generating Alerts
  Description: A network monitoring tool like Wireshark or tcpdump is capturing traffic that includes payloads or commands resembling exploit kit activity