← Back to SOC feed Coverage →

Rule to detect Regin VFSes

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-03T23:00:00Z · Confidence: medium

Hunt Hypothesis

The rule detects potential Regin malware artifacts by identifying suspicious volume file system (VFS) structures that may indicate adversary persistence or data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify early-stage Regin activity and prevent further compromise.

YARA Rule

rule apt_regin_vfs 
{
    
    meta:
        copyright = "Kaspersky Lab"
        author = "Kaspersky Lab"
        description = "Rule to detect Regin VFSes"
        version = "1.0"
        last_modified = "2014-11-18"
    
    strings:
        $a1={00 02 00 08 00 08 03 F6 D7 F3 52}
        $a2={00 10 F0 FF F0 FF 11 C7 7F E8 52}
        $a3={00 04 00 10 00 10 03 C2 D3 1C 93}
        $a4={00 04 00 10 C8 00 04 C8 93 06 D8}
    
    condition:
    ($a1 at 0) or ($a2 at 0) or ($a3 at 0) or ($a4 at 0)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Regin.yar