viotto keylogger

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Viotto keylogger to silently capture user credentials and sensitive input on endpoints within the Azure environment. The SOC team should proactively hunt for this specific YARA signature in Azure Sentinel to identify early-stage reconnaissance activities before they escalate into full-scale data exfiltration incidents.

YARA Rule

rule viotto_keylogger
{
strings:
	$hdr = "MZ"
	$s1 = "Viotto Keylogger"
	$s2 = "msvbvm60"
	$s3 = "FtpPutFileA"
	$s4 = "VBA6"
	$s5 = "SetWindowsHookExA"
condition:
	($hdr at 0) and all of ($s*)

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the viotto_keylogger detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Agent Updates

  • Scenario: The installation or background update of major Endpoint Detection and Response (EDR) agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) often involves dropping DLLs that hook into user input APIs to monitor process behavior. These legitimate hooks can mimic the memory footprint and API calls associated with the Viotto keylogger YARA signature.
  • Suggested Filter: Exclude processes where the ImageName matches known EDR service executables (e.g., C:\Program Files\CrowdStrike\fs.exe, MsMpEng.exe) or restrict the rule to trigger only when the parent process is not a trusted update installer (e.g., msiexec.exe running under the SYSTEM account).

• Enterprise Password Management Tools

  • Scenario: Deployment of corporate password vaults and management suites, such as LastPass Enterprise, 1Password Business, or CyberArk Endpoint Privilege Agent. These tools install background services that capture keystrokes to facilitate auto-fill functionality and secure credential injection. The YARA rule may flag the keylogger module within these applications as a standalone threat rather than part of an authorized suite.
  • Suggested Filter: Create an exclusion based on the file hash or digital signature publisher (e.g., “LastPass.com”, “AgileBits Inc.”, “CyberArk Software Ltd.”) and ensure the rule ignores files located within the standard Program Files directory for these specific vendors.

• Scheduled Remote Desktop and Monitoring Sessions

  • Scenario: Automated scheduled jobs running remote support tools like TeamViewer, AnyDesk, or Splunk Universal Forwarder agents that perform