detect TSCookie in memory

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging the TSCookie mechanism to establish persistent footholds within Azure workloads by embedding tracking tokens directly into system memory. Proactive hunting for this specific artifact is essential to identify early-stage reconnaissance or lateral movement activities that may evade traditional network-based detection controls in the Sentinel environment.

YARA Rule

rule TSCookie {
          meta:
            description = "detect TSCookie in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"
            hash1 = "6d2f5675630d0dae65a796ac624fb90f42f35fbe5dec2ec8f4adce5ebfaabf75"

          strings:
            $v1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" wide
            $b1 = { 68 D4 08 00 00 }

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the detect TSCookie in memory rule within an enterprise environment, along with suggested filters or exclusions:

• Citrix Workspace App Background Processes

  • Scenario: The Citrix Workspace application (commonly used for VDI access) frequently loads TSCookie strings into its memory space during the initialization of secure sessions and background policy checks. This often occurs on user workstations even when no active remote session is established, triggering the rule due to the presence of the cookie in the process heap.
  • Filter/Exclusion: Exclude processes with the executable path C:\Program Files\Citrix\ICA Client\* or specifically target the wfcrun32.exe and Citrix_WebHelper.exe binaries.

• Scheduled Enterprise Backup Jobs

  • Scenario: Automated backup agents (such as Veeam Agent for Windows or Commvault) often mount virtual disks or access shared repositories that utilize Citrix infrastructure components. During the scheduled nightly job execution, these agents may spawn temporary worker processes that inherit memory segments containing TSCookie artifacts from the underlying hypervisor or management console.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 01:00–05:00 local time) for known backup service accounts, or exclude process names matching VeeamAgent.exe, cvpsservice.exe, and their child processes.

• ITSM Ticketing System Updates

  • Scenario: When IT administrators run bulk update scripts or synchronization jobs via tools like ServiceNow or Jira (often accessed through a Citrix-hosted portal), the background service accounts executing these scripts may load TSCookie data into memory to validate session tokens for API calls. This is particularly common during end-of-month reporting cycles.