RAT Orcus

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Orcus Remote Access Trojan to establish persistent command-and-control channels within Azure environments, leveraging its specific behavioral signatures for lateral movement and data exfiltration. Proactive hunting is essential in Azure Sentinel because early detection of this low-severity threat prevents silent long-term compromise before it escalates into a critical incident involving sensitive cloud asset exposure.

YARA Rule

rule RAT_Orcus 
{

    meta:
        author = " J from THL <[email protected]> with thx to MalwareHunterTeam"
        date = "2017/01"
        reference = "https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/"
        version = 1
        maltype = "RAT"
        filetype = "memory"

    strings:
        $text01 = "Orcus.CommandManagement"
        $text02 = "Orcus.Commands."
        $text03 = "Orcus.Config."
        $text04 = "Orcus.Connection."
        $text05 = "Orcus.Core."
        $text06 = "Orcus.exe"
        $text07 = "Orcus.Extensions."
        $text08 = "Orcus.InstallationPromptForm"
        $text09 = "Orcus.MainForm."
        $text10 = "Orcus.Native."
        $text11 = "Orcus.Plugins."
        $text12 = "orcus.plugins.dll"
        $text13 = "Orcus.Properties."
        $text14 = "Orcus.Protection."
        $text15 = "Orcus.Share."
        $text16 = "Orcus.Shared"
        $text17 = "Orcus.StaticCommands"
        $text18 = "Orcus.Utilities."
        $text19 = "\\Projects\\Orcus\\Source\\Orcus."
        $text20 = ".orcus.plugins.dll.zip"
        $text21 = ".orcus.shared.dll.zip"
        $text22 = ".orcus.shared.utilities.dll.zip"
        $text23 = ".orcus.staticcommands.dll.zip"
        $text24 = "HvncCommunication"
        $text25 = "HvncAction"
        $text26 = "hvncDesktop"
        $text27 = ".InstallationPromptForm"
        $text28 = "RequestKeyLogCommand"
        $text29 = "get_KeyLogFile"
        $text30 = "LiveKeyloggerCommand"
        $text31 = "ORCUS.STATICCOMMANDS, VERSION="
        $text32 = "PrepareOrcusFileToRemove"
        $text33 = "ConvertFromOrcusValueKind"

    condition:
        13 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 33 string patterns in its detection logic.

References

• https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the RAT Orcus detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Antivirus Real-Time Scanning of Compressed Archives

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently scan .zip or .7z archives containing large binary payloads. The YARA rule may match the internal structure of these compressed files against Orcus’s specific PE header signatures, triggering alerts when a user extracts a software installer package.
  • Filter/Exclusion: Exclude processes where the parent process is the primary AV service (e.g., C:\Program Files\CrowdStrike\fsa.exe or MsMpEng.exe) and the file extension is .zip, .7z, or .cab. Additionally, filter out alerts where the file size exceeds 50MB, as Orcus payloads are typically smaller.

• Scenario: Scheduled Software Deployment via SCCM/Intune

  • Context: During nightly maintenance windows, Microsoft Endpoint Configuration Manager (MECM) or Microsoft Intune deploys application updates to workstations. The deployment agent (ccmexec.exe or intunagent) often extracts and stages executables that contain standard Windows libraries which share byte-sequence patterns with the Orcus detection logic.
  • Filter/Exclusion: Create an exclusion for processes spawned by ccmexec.exe occurring between 02:00 and 06:00 local time. Specifically, filter out events where the file path contains \CCMCache\ or \AppData\Local\AppVClient\.

• Scenario: Database Backup and Recovery Operations

  • Context: Automated backup jobs using tools like Veeam Backup & Replication