Sakula v1.0

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging the “Sakula v1.0” activity pattern to establish a persistent foothold or conduct initial reconnaissance within the Azure environment. The SOC team should proactively hunt for this behavior in Sentinel to identify early-stage indicators of compromise before they escalate into higher-severity incidents, ensuring timely containment despite the rule’s current low severity classification.

YARA Rule

rule sakula_v1_0: RAT
{
    meta:
        description = "Sakula v1.0"
        date = "2015-10-13"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
    strings:
        $m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "=%s&type=%d"
        $m4 = "?photoid="
        $m5 = "iexplorer"
                $m6 = "net start \"%s\""
        $v1_1 = "MicroPlayerUpdate.exe"
        $MZ = "MZ"
    condition:
        $MZ at 0 and all of ($m*) and not $v1_1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Sakula v1.0 detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Patch Management Deployment

  • Scenario: The Windows Update Agent (or tools like WSUS, SCCM/MECM, and Ansible) executes scheduled patch installation tasks during maintenance windows. These jobs often trigger high-volume file modifications, registry changes, or service restarts that mimic the behavior Sakula v1.0 is designed to detect as suspicious activity.
  • Suggested Filter: Exclude processes originating from C:\Windows\SoftwareDistribution and specific service accounts (e.g., NT AUTHORITY\SYSTEM, DOMAIN\PatchAdmin) during defined maintenance windows (e.g., Sundays 02:00–06:00 UTC).

• Enterprise Antivirus Scanning Cycles

  • Scenario: Full system scans initiated by CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint generate extensive file I/O and network traffic. The heuristic engine of these AV solutions may scan executable files in real-time, creating a burst of events that Sakula v1.0 flags as anomalous process execution or data access patterns.
  • Suggested Filter: Create an exclusion rule for the specific AV service executables (e.g., C:\Program Files\CrowdStrike\csagent.exe, MsMpEng.exe) and their associated child processes, ensuring they do not trigger alerts unless accompanied by a high-severity threat signature.

• Database Backup and Maintenance Jobs

  • Scenario: Scheduled SQL Server maintenance tasks (using SQL Agent) or third-party backup solutions like Veeam Backup & Replication perform large data extraction, compression, and replication to storage arrays. These operations involve massive read/write