← Back to SOC feed Coverage →

Detects strings from dext module - Project Sauron report by Kaspersky

yara LOW Yara-Rules
communityproject_sauron
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-03T23:00:00Z · Confidence: medium

Hunt Hypothesis

The detection of strings from the dext module associated with Project Sauron indicates potential adversarial activity involving malware distribution or command-and-control infrastructure. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify early-stage threats and prevent lateral movement or data exfiltration.

YARA Rule

rule APT_Project_Sauron_dext_module 
{

    meta:
        description = "Detects strings from dext module - Project Sauron report by Kaspersky"
        author = "Florian Roth"
        reference = "https://goo.gl/eFoP4A"
        date = "2016-08-08"
    
    strings:
        $x1 = "Assemble rows of DNS names back to a single string of data"
        $x2 = "removes checks of DNS names and lengths (during split)"
        $x3 = "Randomize data lengths (length/2 to length)"
        $x4 = "This cruft"
    
    condition:
        2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Sauron_extras.yar