xtreme rat 1

Hunt Hypothesis

This detection targets the execution of the Xtreme RAT payload within the Azure Sentinel environment to identify potential command-and-control communications or lateral movement activities associated with this specific remote access tool. Proactive hunting is essential because, despite its current low severity classification, early identification of this known threat allows the SOC team to validate its benign status or uncover stealthy adversary operations before they escalate into critical incidents.

YARA Rule

rule xtreme_rat_1
{ 
	meta:
		maltype = "Xtreme RAT"
		ref = "https://github.com/reed1713"
		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/xtreme-rat-targets-israeli-government/"
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="5156"
		$data="windows\\system32\\sethc.exe"

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="AppData\\Local\\Temp\\Microsoft Word.exe"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://blog.trendmicro.com/trendlabs-security-intelligence/xtreme-rat-targets-israeli-government/
• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the xtreme_rat_1 detection rule in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Protection Scans by CrowdStrike Falcon

  • Scenario: The CrowdStrike Falcon sensor performs a scheduled deep scan of system directories (e.g., C:\Windows\System32), spawning the csfalcon.exe process to read and analyze executable files. This activity mimics the file manipulation behavior often associated with RATs, triggering the YARA rule when the scanner accesses its own binaries or third-party applications during peak hours.
  • Filter/Exclusion: Exclude processes where the parent image path is C:\Program Files\CrowdStrike\csfalcon.exe and the command line contains arguments related to scheduled scans (e.g., /scan, /on-demand).

• Microsoft System Center Configuration Manager (SCCM) Software Updates

  • Scenario: The SCCM client (ccmexec.exe) initiates a deployment package to install critical security patches or new application versions. During the installation phase, it creates temporary files and modifies registry keys in the Program Files directory, which can be misidentified as the lateral movement or persistence mechanisms typical of the Xtreme RAT family.
  • Filter/Exclusion: Create an exclusion for the process image path C:\Windows\CCM\CcmExec.exe specifically when the command line includes the /install flag or references known SCCM package IDs (e.g., PKGID=ABC123).

• Automated Backup Jobs via Veeam Agent

  • Scenario: A scheduled nightly backup job executed by Veeam Agent (veeamagent.exe) creates a snapshot of the system volume. This involves intense I/O operations and temporary file creation in the C:\ProgramData\Veeam directory, which