PoetRat Doc

Hunt Hypothesis

This detection targets adversaries leveraging the PoetRat malware to execute malicious payloads within Microsoft Word documents, a common vector for initial access and lateral movement. Proactively hunting for this behavior in Azure Sentinel is critical because early identification of these low-severity document-based threats can prevent silent data exfiltration before it escalates into a significant incident.

YARA Rule

rule PoetRat_Doc
{
    meta:
        Author = "Nishan Maharjan"
        Description = "A yara rule to catch PoetRat Word Document"
        Data = "6th May 2020"
    strings:
        $pythonRegEx = /(\.py$|\.pyc$|\.pyd$|Python)/  // checking for python strings

        // Python file strings in the word documents
        $pythonFile1 = "launcher.py"
        $zipFile = "smile.zip"
        $pythonFile2 = "smile_funs.py"
        $pythonFile3 = "frown.py"
        $pythonFile4 = "backer.py"
        $pythonFile5 = "smile.py"
        $pythonFile6 = "affine.py" 

        // dlls and cmd strings
        $dlls = /\.dll/
        $cmd = "cmd"
        $exe = ".exe"   
    condition:
    all of them        
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PoetRat Doc detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Automated Macro Deployment via Microsoft Office 365 Admin Center

  • Context: The IT Operations team uses a scheduled PowerShell job to push standardized .docm (macro-enabled) templates containing security policies to all user desktops. These documents contain embedded VBA macros that initialize upon opening, which mimics the behavior of PoetRat’s macro execution payload.
  • Filter/Exclusion: Exclude files where the File Hash matches a known whitelist of corporate template hashes OR filter for processes spawned by Microsoft Office 365 ProPlus (WINWORD.EXE) running under the context of the specific deployment service account (e.g., svc-doc-deploy).

• Scenario: Legacy Document Conversion via Adobe Acrobat Pro DC

  • Context: The Finance department utilizes a nightly batch job using Adobe Acrobat Pro DC to convert high-volume PDF reports into editable Word documents for external auditing. This conversion process often injects temporary VBA code and XML metadata structures that trigger the YARA signature’s heuristic checks for “document manipulation.”
  • Filter/Exclusion: Create an exclusion rule for events originating from the Acrobat.exe process path (C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe) where the file extension is .docx or .docm and the action timestamp falls within the defined maintenance window (e.g., 02:00 – 04:00 local time).

• Scenario: Endpoint Protection Scanning by CrowdStrike Falcon

  • Context: During peak business hours, the CrowdStrike Falcon sensor performs deep inspection scans on user workstations. When scanning active documents in the