detect SmokeLoader in memory

Hunt Hypothesis

This detection rule identifies the presence of the SmokeLoader malware within system memory, signaling a potential initial foothold for adversaries executing fileless attacks or living-off-the-land techniques. Proactively hunting for this behavior in Azure Sentinel is critical to uncover stealthy infections that may evade traditional disk-based scanning and prevent lateral movement before command-and-control channels are established.

YARA Rule

rule SmokeLoader {
          meta:
            description = "detect SmokeLoader in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "https://www.cert.pl/en/news/single/dissecting-smoke-loader/"

          strings:
            $a1 = { B8 25 30 38 58 }
            $b1 = { 81 3D ?? ?? ?? ?? 25 00 41 00 }
            $c1 = { C7 ?? ?? ?? 25 73 25 73 }

          condition: $a1 and $b1 and $c1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the SmokeLoader detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Endpoint Protection Scans by CrowdStrike Falcon or Microsoft Defender
- Scenario: The EDR agent performs a deep memory scan of all running processes to identify known malware signatures. During this scan, the agent may inject itself into the address space of critical system services (like svchost.exe or lsass.exe) using techniques that mimic SmokeLoader’s in-memory execution and hooking behaviors.
- Filter/Exclusion: Exclude process trees where the parent process is a known security vendor executable (e.g., C:\Program Files\CrowdStrike\fsa.exe or C:\Windows\System32\MsMpEng.exe) and the child process matches standard OS service names.
Scheduled Software Updates via SCCM (System Center Configuration Manager)
- Scenario: During a scheduled maintenance window, the SCCM client (ccmexec.exe) downloads and installs patches for enterprise applications (e.g., Adobe Reader or Java). The update installer often extracts payloads directly into memory before writing to disk to speed up deployment, triggering the “in-memory execution” signature associated with SmokeLoader.
- Filter/Exclusion: Create a rule exclusion based on the parent process ccmexec.exe running during defined maintenance windows (e.g., 02:00–04:00 UTC) and restrict detection to non-standard user accounts (exclude SYSTEM or NT AUTHORITY\Network Service).
CI/CD Pipeline Agents Running on Build Servers
- Scenario: On build servers running Jenkins or GitLab CI runners, the agent process (java.exe or node.exe) frequently loads dynamic libraries and scripts into memory to compile code or run unit tests. These