← Back to SOC feed Coverage →

APT28 downdelph magic string

yara LOW Yara-Rules
aptcommunityfancybear_downdelph
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-12T23:00:00Z · Confidence: medium

Hunt Hypothesis

The detection identifies potential APT28 group activity through the use of a known downdelph magic string, which may indicate the presence of a malicious payload or command-and-control communication. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify early-stage compromises and disrupt adversarial operations before they escalate.

YARA Rule

rule APT_fancybear_Downdelph_magic : Bootkit{
	meta:
		author = "Marc Salinas @Bondey_m"
		description = "APT28 downdelph magic string"
		reference = "https://www.threatminer.org/_reports/2016/eset-sednit-part3%20-%20ESET.pdf#viewer.action=download"
	strings:
		$str1 = " :3 "
	condition:
		$str1 at 0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_fancybear_downdelph.yar