detect Ramnit

Hunt Hypothesis

This detection rule identifies the specific file system and registry modifications characteristic of the Ramnit malware, which often establishes persistence by injecting itself into legitimate browser processes. Proactively hunting for this behavior in Azure Sentinel is critical because Ramnit’s ability to spread laterally across a network via shared drives can lead to widespread infection before traditional signature-based alerts trigger.

YARA Rule

rule Ramnit {
          meta:
            description = "detect Ramnit"
            author = "nazywam"
            module = "ramnit"
            reference = "https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/"

          strings:
            $guid = "{%08X-%04X-%04X-%04X-%08X%04X}"
            $md5_magic_1 = "15Bn99gT"
            $md5_magic_2 = "1E4hNy1O"
            $init_dga = { C7 ?? ?? ?? ?? ?? FF FF FF FF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 75 ?? }
            $xor_secret = { 8A ?? ?? 32 ?? 88 ?? 4? 4? E2 ?? }
            $init_function = { FF 35 [4] 68 [4] 68 [2] 00 00 68 [4] E8 [4] FF 35 [4] 68 [4] 68 [2] 00 00 68 [4] E8 [4] FF 35 [4] 68 [4] 68 [2] 00 00 68 [4] E8 [4] FF 35 [4] 68 [4] 68 [2] 00 00 68 [4] E8 }
            $dga_rand_int = { B9 1D F3 01 00 F7 F1 8B C8 B8 A7 41 00 00 }
            $cookies = "cookies4.dat"
            $s3 = "pdatesDisableNotify"
            $get_domains = { a3 [4] a1 [4] 80 3? 00 75 ?? c7 05 [4] ff ff ff ff ff 35 [4] ff 35 [4] ff 35 [4] e8 }
            $add_tld = { 55 8B EC  83 ?? ?? 57 C7 ?? ?? 00 00 00 00 B? ?? ?? ?? ?? 8B ?? ?? 3B ?? ?? 75 ?? 8B ?? }
            $get_port = { 90 68 [4] 68 [4] FF 35 [4] FF 35 [4] E8 [4] 83 }

          condition: $init_dga and $init_function and 2 of ($guid, $md5_magic_*, $cookies, $s3) and any of ( $get_port, $add_tld, $dga_rand_int, $get_domains, $xor_secret)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 12 string patterns in its detection logic.

References

• https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detect Ramnit rule in an enterprise environment, including suggested filters or exclusions:

• Antivirus Definition Updates via Microsoft Defender

  • Scenario: The daily automated update of Microsoft Defender Antivirus triggers a file creation event where the MpCmdRun.exe process writes new signature definitions to %ProgramData%\Microsoft\Windows Defender\Definition. Ramnit is known for modifying registry keys and creating files in similar system directories; if the detection logic relies heavily on file creation patterns without verifying the parent process, this routine update may be flagged as suspicious activity.
  • Filter/Exclusion: Exclude events where the ProcessName is MpCmdRun.exe or MsMpEng.exe and the CommandLine contains arguments related to -Update, -Scan, or -Install.

• Software Deployment via SCCM (System Center Configuration Manager)

  • Scenario: During a scheduled maintenance window, the SCCM client (ccmexec.exe) deploys a new application package. This process often involves extracting compressed archives and writing executable files to C:\Windows\CCMCache or user-specific installation directories. If the detection logic flags the creation of .exe or .dll files in these paths as potential Ramnit persistence mechanisms, legitimate deployments will generate high-volume false positives.
  • Filter/Exclusion: Create an exclusion rule for processes originating from ccmexec.exe where the SourcePath includes \CCMCache\ or the installation package ID matches known enterprise software deployment IDs (e.g., specific AppIDs in the event metadata).

• Group Policy Object (GPO) Application and Script Execution

  • Scenario: The gpupdate.exe process executes scheduled Group Policy scripts that modify registry keys under HKLM\Software\Policies or create log files in `%