WhiskeyBravo

Hunt Hypothesis

This detection targets adversary behavior involving specific executable patterns identified by the WhiskeyBravo YARA signature, which may indicate early-stage reconnaissance or lateral movement attempts within the environment. Proactive hunting for this signal in Azure Sentinel is essential to validate low-severity alerts against known benign processes and uncover potential stealthy threats that might otherwise be overlooked during routine monitoring.

YARA Rule

rule WhiskeyBravo
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - [email protected]"
		Source = "74eac0461c40316689ac2d598f606caa3965195b22f23d5acefeedfcdf056c5b"
		Source = "d079a266ed2a852c33cdac3df115d163ebbf2c8dae32d935e895cf8193163b13"

	strings:
	/*
		6A 04              push    4               ; MaxCount  <--- this arg is not found in some variants (41bad..) as wcscmp is used instead
		68 08 82 00 10     push    offset Str2     ; ".doc"
		56                 push    esi             ; Str1
		FF D7              call    edi ; _wcsnicmp            <--- d07... variant uses a direct call instead
		83 C4 0C           add     esp, 0Ch										<--- when wcscmp is used, this is add esp, 8
		85 C0              test    eax, eax
		0F 84 5B 02 00 00  jz      loc_100017D5
		6A 05              push    5               ; MaxCount
		68 FC 81 00 10     push    offset a_docx   ; ".docx"
		56                 push    esi             ; Str1
		FF D7              call    edi ; _wcsnicmp
		83 C4 0C           add     esp, 0Ch
		85 C0              test    eax, eax
		0F 84 46 02 00 00  jz      loc_100017D5
		6A 04              push    4               ; MaxCount
		68 F0 81 00 10     push    offset a_docm   ; ".docm"
		56                 push    esi             ; Str1
		FF D7              call    edi ; _wcsnicmp
		83 C4 0C           add     esp, 0Ch
		85 C0              test    eax, eax
		0F 84 31 02 00 00  jz      loc_100017D5
		6A 04              push    4               ; MaxCount
		68 E4 81 00 10     push    offset a_wpd    ; ".wpd"
		56                 push    esi             ; Str1
		FF D7              call    edi ; _wcsnicmp
	*/

	$a = {68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 [4] [0-2] 68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 [4] [0-2] 68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 }

	$ext1 = ".wpd" wide nocase
	$ext2 = ".doc" wide nocase
	$ext3 = ".hwp" wide nocase
	
	condition:
		2 of ($ext*) and $a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the WhiskeyBravo detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Agent Self-Replication and Updates

  • Scenario: The primary endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled background update. During this process, the agent executable (csagent.exe or MsMpEng.exe) spawns child processes to download patches and inject signatures into memory, mimicking the behavior of an unauthorized script execution often flagged by WhiskeyBravo.
  • Filter/Exclusion: Whitelist the specific parent process paths (e.g., C:\Program Files\CrowdStrike\csagent.exe or C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe) and exclude any child processes spawned directly from these parents within a 5-minute window of the scheduled maintenance job.

• Enterprise Software Deployment via SCCM/Intune

  • Scenario: The System Center Configuration Manager (SCCM) or Microsoft Intune deployment engine pushes a new application package to workstations. This triggers the ccmexec.exe or Microsoft.Workplace.Join.exe process to extract compressed archives and execute temporary PowerShell scripts (powershell.exe -NoProfile) to configure registry keys, which generates high-volume file creation events indistinguishable from lateral movement activities.
  • Filter/Exclusion: Create an exclusion rule for processes launched by the SCCM client service (ccmexec.exe) or Intune Management Extension that target specific deployment folders (e.g., C:\Windows\CCMCache or C:\Program Files\Microsoft Intune Management Extension). Additionally, filter out PowerShell commands containing known SCCM argument strings like -ExecutionPolicy Bypass.

• Scheduled Antivirus Deep Scan Jobs

  • Scenario: A