Detects malware from Project Sauron APT

Hunt Hypothesis

Adversaries associated with Project Sauron APT may use custom malware to establish persistence and exfiltrate data, which could indicate a long-term compromise. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential advanced persistent threats before they cause significant damage.

YARA Rule

rule APT_Project_Sauron_Custom_M4 
{

    meta:
        description = "Detects malware from Project Sauron APT"
        author = "FLorian Roth"
        reference = "https://goo.gl/eFoP4A"
        date = "2016-08-09"
        hash1 = "e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57"

    strings:
        $s1 = "xpsmngr.dll" fullword wide
        $s2 = "XPS Manager" fullword wide
        $op0 = { 89 4d e8 89 4d ec 89 4d f0 ff d2 3d 08 00 00 c6 } /* Opcode */
        $op1 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 04 20 5b } /* Opcode */
        $op2 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 b6 } /* Opcode */

    condition:
        ( uint16(0) == 0x5a4d and filesize < 90KB and ( all of ($s*) ) and 1 of ($op*) ) or ( all of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Scenario: Legitimate scheduled backup job using Veeam Backup & Replication
Filter/Exclusion: Check for process.name containing “Veeam” and process.parent.name containing “task scheduler” or “schtasks.exe”
Scenario: System update via Windows Update using wuauclt.exe
Filter/Exclusion: Filter by process.name containing “wuauclt.exe” and check for process.parent.name containing “services.exe” or “svchost.exe”
Scenario: Admin task to run PowerShell scripts for configuration management
Filter/Exclusion: Use process.name containing “powershell.exe” and check for process.parent.name containing “task scheduler” or “explorer.exe” with known admin scripts
Scenario: Legitimate use of Sysmon (Windows System Monitor) for logging
Filter/Exclusion: Filter by process.name containing “sysmon.exe” and verify process.parent.name is “services.exe” with known Sysmon service configurations
Scenario: Regular execution of Windows Defender Antivirus scan
Filter/Exclusion: Check for process.name containing “MsMpEng.exe” and ensure process.parent.name is “services.exe” with known Windows Defender service identifiers