This detection identifies potential Xtreme RAT activity by monitoring for specific file execution patterns defined in the xtreme_rat_0 YARA signature within Azure Sentinel workloads. Proactively hunting for this behavior is critical because early identification of low-severity RAT indicators allows SOC teams to investigate lateral movement and data exfiltration attempts before they escalate into significant security incidents.
rule xtreme_rat_0
{
meta:
maltype = "Xtreme RAT"
reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/xtreme-rat-targets-israeli-government/"
strings:
$type="Microsoft-Windows-Security-Auditing"
$eventid="5156"
$data="windows\\system32\\sethc.exe"
$type1="Microsoft-Windows-Security-Auditing"
$eventid1="4688"
$data1="AppData\\Local\\Temp\\Microsoft Word.exe"
condition:
all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 6 string patterns in its detection logic.
Here are specific false positive scenarios for the xtreme_rat_0 detection rule in an enterprise environment, along with recommended filters or exclusions:
Endpoint Protection Scanning by CrowdStrike Falcon
csagent.exe process) performs deep file integrity scans on system directories. During these scans, it spawns child processes to analyze executable headers and memory structures, mimicking the behavior of a RAT establishing persistence or monitoring user activity. This often triggers the YARA rule due to similar API call sequences used for file enumeration.ParentImage is C:\Program Files\CrowdStrike\csagent.exe and the process name contains falconcontainer. Additionally, whitelist the specific command line arguments related to “integrity scan” or “file hash verification.”Microsoft SCCM (Configuration Manager) Software Deployment
ccmexec.exe) deploys new applications or patches. The deployment engine creates temporary worker processes that inject code into user sessions to verify installation success and collect telemetry data. This injection and session monitoring behavior closely resembles the “user activity tracking” signature defined in xtreme_rat_0.Microsoft SCCM service account (NT AUTHORITY\SYSTEM or a dedicated SCCM-Deploy-Account) running under the ccmexec.exe parent. Filter specifically for execution paths within C:\Windows\CCM\ and C:\Program Files (x86)\Microsoft Configuration Manager.Enterprise Backup Agent Operations (Veeam Backup & Replication)
vbr.exe) runs scheduled jobs to