detect TSCookie Loader in memory

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing TSCookie Loader to establish persistent in-memory footholds within Azure environments by manipulating browser cookie mechanisms for stealthy command and control communication. The SOC team should proactively hunt for this behavior because early detection of these lightweight memory artifacts can reveal initial compromise stages before traditional file-based signatures trigger, thereby reducing dwell time in the Azure Sentinel ecosystem.

YARA Rule

rule TSC_Loader {
          meta:
            description = "detect TSCookie Loader in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"

          strings:
            $v1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" wide
            $b1 = { 68 78 0B 00 00 }

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detect TSCookie Loader in memory rule, including suggested filters and exclusions:

• Tenable Nessus Agent Scheduled Scans

  • Scenario: The Tenable.io (Nessus) agent performs routine vulnerability assessments on endpoints. During these scans, the tscookie_loader module is actively loaded into memory to parse and validate cookie-based session tokens for web application testing modules. This often occurs during off-hours maintenance windows.
  • Filter/Exclusion: Exclude processes where the parent executable path matches C:\Program Files\Tenable\Nessus Agent\* or specifically filter for the command line argument containing -scan-type=vulnerability.

• Splunk Universal Forwarder (UF) Configuration Reloads

  • Scenario: In environments using Splunk Enterprise Security, the TSCookie Loader is frequently invoked by the Splunk Universal Forwarder when it reloads its configuration files (props.conf or inputs.conf) to ingest new log sources. This triggers a memory load event even though no security threat is present.
  • Filter/Exclusion: Create an exclusion rule for processes with the image path containing \Program Files\SplunkUniversalForwarder\bin\splunk.exe where the process name includes TSCookieLoader and the user context is a service account (e.g., svc_splunk_fwd).

• Microsoft Intune Application Deployment Tasks

  • Scenario: When Microsoft Intune pushes application updates or compliance policies to Windows endpoints, it utilizes background agents that load TSCookie components to manage secure session handshakes during the deployment handshake. This is common during large-scale patch Tuesday deployments.
  • Filter/Exclusion: Exclude events originating from the Microsoft.IntuneManagement service account where the process creation time aligns with known Intune maintenance