← Back to SOC feed Coverage →

Rule to detect encrypted ProjectSauron SSPI samples

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-03T23:00:00Z · Confidence: medium

Hunt Hypothesis

Encrypted ProjectSauron SSPI samples may indicate the presence of a sophisticated adversary leveraging encryption to evade detection and persist within the network. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential advanced threats that could bypass traditional detection mechanisms.

YARA Rule

rule apt_ProjectSauron_encrypted_SSPI  
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect encrypted ProjectSauron SSPI samples"
        version = "1.0"
        reference = "https://securelist.com/blog/"

    condition:
        uint16(0) == 0x5A4D and filesize < 1000000 and pe.exports("InitSecurityInterfaceA") and pe.characteristics & pe.DLL and (pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64) and math.entropy(0x400, filesize) >= 7.5 }

rule apt_ProjectSauron_MyTrampoline  
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect ProjectSauron MyTrampoline module"
        version = "1.0"
        reference = "https://securelist.com/blog/"

    strings:
        $a1 = ":\\System Volume Information\\{" wide
        $a2 = "\\\\.\\PhysicalDrive%d" wide
        $a3 = "DMWndClassX%d"
        $b1 = "{774476DF-C00F-4e3a-BF4A-6D8618CFA532}" ascii wide
        $b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide

    condition:
        uint16(0) == 0x5A4D and filesize < 5000000 and (all of ($a*) or any of ($b*)) }

rule apt_ProjectSauron_encrypted_container  
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect ProjectSauron samples encrypted container"
        version = "1.0"
        reference = "https://securelist.com/blog/"

    strings:
        $vfs_header = {02 AA 02 C1 02 0?}
        $salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}

    condition:
        uint16(0) == 0x5A4D and ((@vfs_header < 0x4000) or $salt) and math.entropy(0x400, filesize) >= 6.5 and (filesize > 0x400) and filesize < 10000000 }

rule apt_ProjectSauron_encryption  
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect ProjectSauron string encryption"
        version = "1.0"
        reference = "https://securelist.com/blog/"

    strings:
        $a1 = {81??02AA02C175??8B??0685}
        $a2 = {918D9A94CDCC939A93939BD18B9AB8DE9C908DAF8D9B9BBE8C8C9AFF}
        $a3 = {803E225775??807E019F75??807E02BE75??807E0309}

    condition:
        filesize < 5000000 and any of ($a*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Sauron.yar