SmallNet

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing small network traffic patterns to evade standard threshold-based detection while establishing covert communication channels within the environment. A proactive hunt is essential in Azure Sentinel to correlate these subtle signals across distributed logs, ensuring early identification of stealthy reconnaissance or command-and-control activities before they escalate into significant incidents.

YARA Rule

rule SmallNet : RAT
{
	meta:
		author = " Kevin Breen <[email protected]>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/SmallNet"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		
	strings:
		$split1 = "!!<3SAFIA<3!!"
		$split2 = "!!ElMattadorDz!!"
		$a1 = "stub_2.Properties"
		$a2 = "stub.exe" wide
		$a3 = "get_CurrentDomain"

	condition:
		($split1 or $split2) and (all of ($a*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SmallNet detection rule in an enterprise environment, along with suggested filters and exclusions:

• Scenario: Automated Vulnerability Scanning by Qualys or Tenable

  • Context: Enterprise vulnerability scanners frequently deploy lightweight agents to perform rapid network discovery. These agents often spin up temporary, small-footprint processes that mimic the behavior of SmallNet (e.g., establishing short-lived connections with minimal resource usage) to map the internal topology before a full scan begins.
  • Suggested Filter/Exclusion: Create an exclusion for known scanner agent binaries (e.g., qualyspc.exe, tenable_agent.exe) and their associated service accounts. Additionally, filter out traffic originating from the specific subnet dedicated to security scanning infrastructure.

• Scenario: Microsoft System Center Configuration Manager (SCCM) Software Updates

  • Context: During scheduled maintenance windows, SCCM agents push small configuration updates or “heartbeat” checks to endpoints. These tasks often involve a background service that initiates brief network sessions with low bandwidth consumption, which can be misidentified as the SmallNet activity pattern if the rule focuses on connection duration and packet size.
  • Suggested Filter/Exclusion: Exclude processes running under the CCMExec executable path (C:\Windows\CCM\) and filter events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC). Whitelist the specific hash of the SCCM agent update service.

• Scenario: Azure Arc or AWS Systems Manager (SSM) Agent Connectivity

  • Context: Cloud management agents like Azure Arc or AWS SSM constantly poll for commands and report status. These agents often utilize a “small net” architecture to maintain persistent but low-volume connections to the cloud control plane, which matches the YARA signature’s definition of