PoisonIvy 2

Hunt Hypothesis

This detection identifies adversary activity associated with the Poison Ivy ransomware family by leveraging a specific YARA signature to pinpoint known malicious artifacts within the environment. Proactively hunting for this behavior in Azure Sentinel is critical because early identification of these low-severity indicators allows the SOC team to isolate potential infection vectors before they escalate into full-scale encryption attacks.

YARA Rule

rule PoisonIvy_2
{
	meta:
		author = " Kevin Breen <[email protected]>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/PoisonIvy"
		maltype = "Remote Access Trojan"
		filetype = "exe"

    strings:
    	$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
        $string1 = "CONNECT %s:%i HTTP/1.0"
        $string2 = "ws2_32"
        $string3 = "cks=u"
        $string4 = "thj@h"
        $string5 = "advpack"
    condition:
		$stub at 0x1620 and all of ($string*) or (all of them)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the PoisonIvy 2 detection rule in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Protection Scanning and Updates

  • Scenario: The YARA rule detects legitimate file system enumeration and DLL injection activities performed by major Endpoint Detection and Response (EDR) agents during routine scans or definition updates. Specifically, tools like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint often spawn child processes that mimic the memory manipulation behaviors of PoisonIvy to verify integrity.
  • Filter/Exclusion: Create an exclusion based on the parent process image path and name. Exclude events where ParentImage matches known EDR binaries (e.g., C:\Program Files\CrowdStrike\csfalcon.exe, C:\Windows\System32\MsMpEng.exe) and the child process is a known scanner component (e.g., MsMpEng.exe spawning MsMpRes.dll).

• Scheduled Software Deployment via SCCM/Intune

  • Scenario: During business hours or maintenance windows, enterprise deployment tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Microsoft Intune execute application installations. These tasks frequently involve copying large numbers of files to user profiles and modifying registry keys in a manner that triggers the “file creation” and “registry modification” logic within the PoisonIvy_2 YARA rule.
  • Filter/Exclusion: Implement a time-based exclusion combined with process filtering. Exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the initiating process is ccmexec.exe or IntuneManagementExtension.exe. Additionally, filter out file paths containing standard deployment directories like C:\Windows\CCMCache\ or `C:\