PoisonIvy RAT Generic Rule

Hunt Hypothesis

This detection rule identifies the presence of the Poison Ivy Remote Access Trojan (RAT), which adversaries deploy to establish persistent command-and-control channels and execute remote tasks on compromised endpoints. Proactively hunting for this behavior in Azure Sentinel is critical because early identification of this low-severity but stealthy malware enables SOC teams to isolate affected assets before the RAT escalates to data exfiltration or lateral movement activities.

YARA Rule

rule PoisonIvy_Generic_3 {
	meta:
		description = "PoisonIvy RAT Generic Rule"
		author = "Florian Roth"
		date = "2015-05-14"
		hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
	strings:
		$k1 = "Tiger324{" fullword ascii
		
		$s2 = "WININET.dll" fullword ascii
		$s3 = "mscoree.dll" fullword wide
		$s4 = "WS2_32.dll" fullword
		$s5 = "Explorer.exe" fullword wide
		$s6 = "USER32.DLL"
		$s7 = "CONOUT$"
		$s8 = "login.asp"
		
		$h1 = "HTTP/1.0"
		$h2 = "POST"
		$h3 = "login.asp"
		$h4 = "check.asp"
		$h5 = "result.asp"
		$h6 = "upload.asp"
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and
			( 
				$k1 or all of ($s*) or all of ($h*)
			)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 14 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PoisonIvy RAT Generic Rule, including suggested filters or exclusions tailored for an enterprise environment:

• Endpoint Protection Agent Updates

  • Scenario: The rule triggers when the CrowdStrike Falcon or SentinelOne agent performs a scheduled background update. These agents often inject code into svchost.exe or launch temporary helper processes (falconupdater.exe, sentinel-agent-helper) that utilize memory injection techniques and network beaconing patterns identical to PoisonIvy’s initial deployment phase.
  • Filter/Exclusion: Exclude process paths containing known EDR vendor directories (e.g., C:\Program Files\CrowdStrike\ or C:\SentinelOne\) and whitelist the specific parent-child process relationships (svchost.exe spawning falconupdater.exe).

• Software Deployment via SCCM/MECM

  • Scenario: During a scheduled patch Tuesday deployment, Microsoft Endpoint Configuration Manager (SCCM) executes installation scripts that utilize PowerShell to modify registry keys and inject DLLs into running sessions. The generic rule may misinterpret the ccmexec.exe spawning of temporary PowerShell instances with elevated network activity as a RAT establishing persistence.
  • Filter/Exclusion: Create an exclusion for processes initiated by ccmexec.exe or Task Scheduler jobs with names containing “SoftwareUpdate” or “PatchDeployment,” specifically filtering out the execution of powershell.exe when the command line arguments include -WindowStyle Hidden.

• ITSM Ticketing System Agents

  • Scenario: The ServiceNow Agent or Ivanti Endpoint Manager runs a daily inventory scan. These agents frequently spawn child processes to enumerate hardware and software, utilizing network sockets to send large JSON payloads back to the management server. This behavior mimics Poison