Find a constant used as part of a payload decoding function in PolishBankRAT_fdsvc

Hunt Hypothesis

This hunt targets adversaries deploying PolishBankRAT by identifying the specific constant signature associated with its payload decoding mechanism within fdsvc processes. Proactively searching for this indicator in Azure Sentinel is critical to detect early-stage command-and-control activities that may evade standard signature-based defenses due to their low severity classification.

YARA Rule

rule PolishBankRAT_fdsvc_decode2 
{
	meta:
		
		author = "Booz Allen Hamilton Dark Labs"
		description = "Find a constant used as part of a payload decoding function in PolishBankRAT_fdsvc"

	strings:
		
		$part1 = {A6 EB 96}
		$part2 = {61 B2 E2 EF}
		$part3 = {0D CB E8 C4}
		$part4 = {5A F1 66 9C}
		$part5 = {A4 80 CD 9A}
		$part6 = {F1 2F 46 25}
		$part7 = {2F DB 16 26}
		$part8 = {4B C4 3F 3C}
		$str1 = "This program cannot be run in DOS mode"

	condition:

		(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PolishBankRAT_fdsvc detection rule, tailored for an enterprise environment:

• Legacy Java Application Deployment via Jenkins Pipeline

  • Scenario: During a nightly build and deployment cycle, the CI/CD pipeline (Jenkins) extracts a legacy banking module written in Java. The fdsvc (File Distribution Service) component within this application utilizes a specific hardcoded constant string to initialize its payload decoder before processing transaction logs. This activity mimics the exact signature of the RAT’s decoding function initialization.
  • Suggested Filter/Exclusion: Exclude processes spawned by the Jenkins agent service (java.exe or mvn.cmd) running under the Jenkins-Service user account, specifically when the command line arguments contain -Dfdsvc.decode=true.

• Scheduled Database Backup and Archiving Job

  • Scenario: A scheduled Windows Task runs every Sunday at 02:00 AM to archive financial records. The backup utility (e.g., Veeam or a custom PowerShell script invoking sqlcmd) invokes the fdsvc library to compress and encode large binary payloads before writing them to the NAS storage. The constant used for payload chunking in this legitimate archival process matches the RAT’s signature.
  • Suggested Filter/Exclusion: Create an exclusion rule for the specific scheduled task name (e.g., \PolishBank\WeeklyArchive) and restrict the alert to only trigger if the parent process is not TaskScheduler or svchost.exe with the service tag VeeamTransport.

• Third-Party Anti-Malware Heuristic Scan

  • Scenario: The enterprise endpoint protection solution (e.g., CrowdStrike Falcon or Microsoft Defender) performs a deep heuristic scan on the fdsvc executable directory. During this scan, the anti-m