detect zark20rk(a variant of RedLeaves) in memory

Hunt Hypothesis

This hunt targets adversaries executing the Zark20rk (RedLeaves) malware variant within Azure Sentinel workloads by identifying its specific in-memory signatures to confirm active infection. Proactively hunting for this behavior is critical because early detection of this low-severity threat allows the SOC team to isolate compromised assets before the malware establishes persistence or exfiltrates sensitive data.

YARA Rule

rule zark20rk {
          meta:
            description = "detect zark20rk(a variant of RedLeaves) in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"
            hash1 = "d95ad7bbc15fdd112594584d92f0bff2c348f48c748c07930a2c4cc6502cd4b0"

          strings:
            $a1 = { C7 ?? ?? 7A 61 72 6B }
            $a2 = { C7 ?? ?? 32 30 72 6B }

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detect zark20rk (a variant of RedLeaves) rule, tailored for a legitimate enterprise environment:

• Endpoint Protection Scanning by CrowdStrike Falcon

  • Scenario: The CrowdStrike Falcon sensor performs deep memory scanning on high-traffic workstations during its scheduled hourly update cycle. The heuristic engine may flag the specific memory footprint of the csfalcon.exe process or its child threads as resembling the RedLeaves variant due to overlapping behavioral signatures in the heap allocation phase.
  • Filter/Exclusion: Exclude processes with the executable path matching C:\Program Files\CrowdStrike\*\csfalcon.exe and restrict detection to non-business hours (e.g., 02:00–04:00) if the alert volume is high during peak usage.

• Microsoft System Center Configuration Manager (SCCM) Software Updates

  • Scenario: During a scheduled “Patch Tuesday” deployment, the SCCM client (ccmexec.exe) injects code into memory to install Windows updates or third-party patches. The injection mechanism and the temporary loading of update manifests can mimic the in-memory persistence techniques used by the Zark20rk variant, triggering the rule on thousands of endpoints simultaneously.
  • Filter/Exclusion: Create an exclusion for parent process ccmexec.exe and child processes spawned under the Software Center application context. Additionally, correlate alerts with SCCM deployment logs to suppress detections occurring within 15 minutes of a known deployment start time.

• Enterprise Antivirus Real-Time Scanning (Symantec Endpoint Protection)

  • Scenario: Symantec Endpoint Protection initiates an on-demand full system scan requested by the IT helpdesk for a specific department. The scanner’s memory-resident module (ruagent.exe) loads large signature databases