Andromeda is a sophisticated malware that may execute stealthily within a network, leveraging Azure services to maintain persistence and exfiltrate data. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced threats that evade traditional detection methods.
YARA Rule
rule andromeda
{
meta:
author = "Brian Wallace @botnet_hunter"
author_email = "[email protected]"
date = "2014-03-13"
description = "Identify Andromeda"
strings:
$config = {1c 1c 1d 03 49 47 46}
$c1 = "hsk\\ehs\\dihviceh\\serhlsethntrohntcohurrehem\\chsyst"
condition:
all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Scenario: Scheduled System Maintenance Job
Description: A legitimate scheduled task runs a script that uses mshta to execute a maintenance script, which may trigger the Andromeda detection logic.
Filter/Exclusion: Exclude processes initiated by schtasks.exe or with a command line containing mshta and a known maintenance script path (e.g., C:\Windows\System32\mshta.exe "C:\Windows\System32\maintenance.hta").
Scenario: Admin Task Using PowerShell to Deploy Software
Description: An admin uses PowerShell to deploy software via a script that includes mshta to launch a GUI installer, which could be flagged by the rule.
Filter/Exclusion: Exclude processes where the parent process is powershell.exe and the command line includes a known deployment script path (e.g., C:\Windows\System32\mshta.exe "C:\Deployment\installer.hta").
Scenario: Microsoft Update Installer
Description: The Microsoft Update installer may use mshta to launch a GUI-based update wizard, which could trigger the Andromeda detection.
Filter/Exclusion: Exclude processes where the command line includes mshta and the file path is associated with Microsoft Update (e.g., C:\Windows\System32\mshta.exe "C:\Windows\Temp\update.hta").
Scenario: Legacy Application Compatibility Tool
Description: A legacy application compatibility tool uses mshta to run an HTA file for compatibility purposes, which may be flagged as Andromeda activity.
Filter/Exclusion: Exclude processes where the command line includes mshta and the HTA file is located in a known compatibility tool directory (e.g., C:\Program Files\Compatibility Tools\compat.hta).
**Scenario: