Tedroo Spammer

Hunt Hypothesis

This detection identifies anomalous email transmission patterns characteristic of the Tedroo spambot, which often serves as a precursor to more sophisticated phishing or malware campaigns within the organization. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to validate low-severity alerts against known threat intelligence and refine baseline thresholds before these spam activities escalate into targeted attacks.

YARA Rule

rule Tedroo : Spammer
{
	meta:
		author="Kevin Falcoz"
		date="22/11/2015"
		description="Tedroo Spammer"

	strings:
		$signature1={25 73 25 73 2E 65 78 65}
		$signature2={5F 6C 6F 67 2E 74 78 74}

	condition:
		$signature1 and $signature2
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Tedroo Spammer detection rule in an enterprise environment, including suggested filters and exclusions:

• Automated Patch Deployment via WSUS/SCCM

  • Scenario: The System Center Configuration Manager (SCCM) or Windows Server Update Services (WSUS) server initiates a mass update push. This generates high-volume network traffic from the management server to multiple endpoints, mimicking the “spammer” behavior of sending repeated connection attempts or data bursts that the rule flags as anomalous.
  • Filter/Exclusion: Create an exclusion for source IPs belonging to the SCCM-Management subnet and destination ports associated with update services (e.g., TCP 8530, 443). Additionally, filter out events occurring during the defined maintenance window (e.g., Sundays between 02:00–06:00 UTC).

• Scheduled Antivirus Full Scans

  • Scenario: Enterprise endpoint protection tools like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint run scheduled full-system scans. These agents generate a high frequency of file access and network telemetry events as they communicate with the central cloud console, triggering the Tedroo Spammer logic due to the sheer volume of legitimate “chatter.”
  • Filter/Exclusion: Exclude traffic originating from known AV agent service accounts (e.g., svc-antivirus, LocalService) and destination IPs of the vendor’s telemetry endpoints. Add a filter for process names matching standard AV executables (e.g., C:\Program Files\CrowdStrike\csfalcon.exe).

• Backup Agent Data Synchronization

  • Scenario: Backup solutions such as Veeam Backup & Replication, Commvault, or Rubrik perform incremental data