Identifies xRAT 2.0 samples

Hunt Hypothesis

This hunt targets adversary behavior characterized by the deployment of xRAT 2.0 remote access trojans to establish persistent footholds and exfiltrate sensitive data within Azure environments. Proactively hunting for these samples in Azure Sentinel is critical because their low severity classification may cause them to be overlooked during routine alert triage, allowing stealthy reconnaissance activities to persist undetected.

YARA Rule

rule xRAT20 : RAT
{
meta:
	author = "Rottweiler"
	date = "2015-08-20"
	description = "Identifies xRAT 2.0 samples"
	maltype = "Remote Access Trojan"
	hash0 = "cda610f9cba6b6242ebce9f31faf5d9c"
	hash1 = "60d7b0d2dfe937ac6478807aa7043525"
	hash2 = "d1b577fbfd25cc5b873b202cfe61b5b8"
	hash3 = "1820fa722906569e3f209d1dab3d1360"
	hash4 = "8993b85f5c138b0afacc3ff04a2d7871"
	hash5 = "0c231ed8a800b0f17f897241f1d5f4e3"
	hash1 = "60d7b0d2dfe937ac6478807aa7043525"
	hash8 = "2c198e3e0e299a51e5d955bb83c62a5e"
	sample_filetype = "exe"
	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
	$string0 = "GetDirectory: File not found" wide
	$string1 = "<>m__Finally8"
	$string2 = "Secure"
	$string3 = "ReverseProxyClient"
	$string4 = "DriveDisplayName"
	$string5 = "<IsError>k__BackingField"
	$string6 = "set_InstallPath"
	$string7 = "memcmp"
	$string8 = "urlHistory"
	$string9 = "set_AllowAutoRedirect"
	$string10 = "lpInitData"
	$string11 = "reader"
	$string12 = "<FromRawDataGlobal>d__f"
	$string13 = "mq.png" wide
	$string14 = "remove_KeyDown"
	$string15 = "ProtectedData"
	$string16 = "m_hotkeys"
	$string17 = "get_Hour"
	$string18 = "\\mozglue.dll" wide
condition:
	18 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 19 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Identifies xRAT 2.0 samples detection rule in an enterprise environment:

• Endpoint Detection and Response (EDR) Self-Scanning

  • Scenario: The organization’s primary EDR agent, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled deep scan of its own installation directory. During this process, the scanner extracts and analyzes its internal configuration files or signature updates which share structural similarities with xRAT 2.0 artifacts (e.g., specific DLL injection patterns or registry key structures).
  • Suggested Filter: Exclude processes originating from the EDR vendor’s service account (e.g., SYSTEM running CrowdStrike.exe or MsMpEng.exe) when accessing files within the EDR installation path (C:\Program Files\Microsoft Defender\).

• Software Deployment via Configuration Management

  • Scenario: A scheduled deployment job using Ansible or SCCM (System Center Configuration Manager) pushes a new application package to workstations. The installer includes a legacy component library that mimics xRAT 2.0’s file hashing algorithm and creates temporary extraction folders in C:\Windows\Temp containing files with identical naming conventions to the malware sample.
  • Suggested Filter: Create an exclusion for file creation events triggered by known deployment service accounts (e.g., DOMAIN\SVC_Deployment) specifically within standard deployment staging directories (C:\ProgramData\SCCM\Cache\ or C:\Windows\Temp\Ansible-*).

• IT Helpdesk Remote Support Sessions

  • Scenario: An IT support technician initiates a remote session using LogMeIn Rescue or TeamViewer to troubleshoot a user’s workstation. The remote control software injects diagnostic modules into the target machine