← Back to SOC feed Coverage →

Rule to detect ProjectSauron generic pipe backdoors

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-03T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use ProjectSauron generic pipe backdoors to establish persistent, stealthy communication channels within a network. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential long-term persistence mechanisms that evade traditional detection methods.

YARA Rule

rule apt_ProjectSauron_generic_pipe_backdoor 
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect ProjectSauron generic pipe backdoors"
        version = "1.0"
        reference = "https://securelist.com/blog/"

    strings:
        $a = { C7 [2-3] 32 32 32 32 E8 }
        $b = { 42 12 67 6B }
        $c = { 25 31 5F 73 }
        $d = "rand"
        $e = "WS2_32"

condition:
    uint16(0) == 0x5A4D and (all of them) and filesize < 400000

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Sauron.yar