Rooter

Hunt Hypothesis

This detection rule identifies adversaries attempting to establish persistence by creating or modifying local administrator accounts, a critical step in escalating privileges within an Azure environment. Proactive hunting for this behavior is essential because early identification of unauthorized account changes allows the SOC team to mitigate potential lateral movement and data exfiltration before attackers fully compromise the tenant’s security posture.

YARA Rule

rule Rooter : Family
{
    meta:
        description = "Rooter"
        author = "Seth Hardy"
        last_modified = "2014-07-10"
        
    condition:
        RooterCode or RooterStrings
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Rooter detection rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Antivirus Definition Updates via PowerShell

  • Scenario: The enterprise endpoint protection agent (e.g., Microsoft Defender or CrowdStrike) runs a scheduled task every morning at 02:00 to download the latest virus definitions. This process often involves creating temporary directories, modifying registry keys for update paths, and executing powershell.exe with elevated privileges that mimic rooter behavior by altering system configurations.
  • Filter/Exclusion: Create a whitelist rule excluding events where the parent process is the specific AV service (e.g., MsMpEng.exe or csagent.exe) and the command line contains keywords like “update,” “definition,” or specific scheduled task IDs (e.g., Microsoft\Windows Defender).

• Automated Patch Deployment via Configuration Management Tools

  • Scenario: During maintenance windows, tools like Ansible, Puppet, or SCCM execute scripts to apply OS patches. These agents frequently create new service accounts, modify file permissions on critical system folders (e.g., C:\Windows\System32), and install software packages that require administrative rights, triggering the Rooter logic due to the high volume of configuration changes.
  • Filter/Exclusion: Exclude events originating from known management tool executables (e.g., Ansible-Runner.exe, PuppetAgent.exe, or ccmexec.exe) running under a dedicated service account (e.g., DOMAIN\PatchServiceAccount). Additionally, filter by the specific time window of the maintenance schedule.

• Identity and Access Management (IAM) Provisioning Scripts

  • Scenario: IT administrators run nightly scripts using Python or PowerShell to synchronize user identities from HR systems into Active Directory or Azure AD. These scripts often create