← Back to SOC feed Coverage →

botnet bruteforcing POS terms via RDP

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-10T11:00:01Z · Confidence: medium

Hunt Hypothesis

This detection identifies a distributed botnet campaign attempting to compromise Point of Sale (POS) terminals through sustained Remote Desktop Protocol (RDP) brute-force attacks. Proactively hunting for this behavior in Azure Sentinel is critical because early identification allows the SOC team to isolate affected POS assets before credential theft leads to financial data exfiltration or ransomware deployment.

YARA Rule

rule POS_bruteforcing_bot
{ 
	meta:
		maltype = "botnet"
    ref = "https://github.com/reed1713"
		reference = "http://www.alienvault.com/open-threat-exchange/blog/botnet-bruteforcing-point-of-sale-via-remote-desktop"
		date = "3/11/2014"
		description = "botnet bruteforcing POS terms via RDP"
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data="\\AppData\\Roaming\\lsacs.exe"

	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the botnet bruteforcing POS terms via RDP rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/POS_BruteforcingBot.yar