Detecs an implant used by Bemstour exploitation tool (APT3)

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the Bemstour exploitation tool to deploy implants that may evade standard signature-based detection within Azure Sentinel environments. Proactive hunting is essential because APT3’s use of this specific implant often indicates early-stage reconnaissance or lateral movement activities that require immediate investigation before they escalate into more severe incidents.

YARA Rule

rule apt3_bemstour_implant_command_stack_variable
{
meta:

description = "Detecs an implant used by Bemstour exploitation tool (APT3)"
author = "Mark Lechtik"
company = "Check Point Software Technologies LTD."
date = "2019-06-25"
sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"


id = "c773da5a-2d3f-5a0a-af2e-28ad382622b3"
strings:


/*

0x41ba18L C78534FFFFFF636D642E          mov dword ptr [ebp - 0xcc], 0x2e646d63
0x41ba22L C78538FFFFFF65786520          mov dword ptr [ebp - 0xc8], 0x20657865
0x41ba2cL C7853CFFFFFF2F632063          mov dword ptr [ebp - 0xc4], 0x6320632f
0x41ba36L C78540FFFFFF6F707920          mov dword ptr [ebp - 0xc0], 0x2079706f
0x41ba40L C78544FFFFFF2577696E          mov dword ptr [ebp - 0xbc], 0x6e697725
0x41ba4aL C78548FFFFFF64697225          mov dword ptr [ebp - 0xb8], 0x25726964
0x41ba54L C7854CFFFFFF5C737973          mov dword ptr [ebp - 0xb4], 0x7379735c
0x41ba5eL C78550FFFFFF74656D33          mov dword ptr [ebp - 0xb0], 0x336d6574
0x41ba68L C78554FFFFFF325C636D          mov dword ptr [ebp - 0xac], 0x6d635c32
0x41ba72L C78558FFFFFF642E6578          mov dword ptr [ebp - 0xa8], 0x78652e64
0x41ba7cL C7855CFFFFFF65202577          mov dword ptr [ebp - 0xa4], 0x77252065
0x41ba86L C78560FFFFFF696E6469          mov dword ptr [ebp - 0xa0], 0x69646e69
0x41ba90L C78564FFFFFF72255C73          mov dword ptr [ebp - 0x9c], 0x735c2572
0x41ba9aL C78568FFFFFF79737465          mov dword ptr [ebp - 0x98], 0x65747379
0x41baa4L C7856CFFFFFF6D33325C          mov dword ptr [ebp - 0x94], 0x5c32336d
0x41baaeL C78570FFFFFF73657468          mov dword ptr [ebp - 0x90], 0x68746573
0x41bab8L C78574FFFFFF632E6578          mov dword ptr [ebp - 0x8c], 0x78652e63
0x41bac2L C78578FFFFFF65202F79          mov dword ptr [ebp - 0x88], 0x792f2065
0x41baccL 83A57CFFFFFF00                and dword ptr [ebp - 0x84], 0

*/

$chunk_1 = {

C7 85 ?? ?? ?? ?? 63 6D 64 2E
C7 85 ?? ?? ?? ?? 65 78 65 20
C7 85 ?? ?? ?? ?? 2F 63 20 63
C7 85 ?? ?? ?? ?? 6F 70 79 20
C7 85 ?? ?? ?? ?? 25 77 69 6E
C7 85 ?? ?? ?? ?? 64 69 72 25
C7 85 ?? ?? ?? ?? 5C 73 79 73
C7 85 ?? ?? ?? ?? 74 65 6D 33
C7 85 ?? ?? ?? ?? 32 5C 63 6D
C7 85 ?? ?? ?? ?? 64 2E 65 78
C7 85 ?? ?? ?? ?? 65 20 25 77
C7 85 ?? ?? ?? ?? 69 6E 64 69
C7 85 ?? ?? ?? ?? 72 25 5C 73
C7 85 ?? ?? ?? ?? 79 73 74 65
C7 85 ?? ?? ?? ?? 6D 33 32 5C
C7 85 ?? ?? ?? ?? 73 65 74 68
C7 85 ?? ?? ?? ?? 63 2E 65 78
C7 85 ?? ?? ?? ?? 65 20 2F 79
83 A5 ?? ?? ?? ?? 00
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Bemstour (APT3) Implant Detection Rule, including targeted filters and exclusions:

• Scenario: Legitimate Software Deployment via SCCM/Intune

  • Context: Enterprise endpoints often use Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy updates. These tools frequently execute installation scripts that create temporary files, modify registry keys, or spawn child processes with similar hashing patterns to the Bemstour implant’s known signatures, particularly when deploying security agents or system utilities.
  • Filter/Exclusion: Create a whitelist based on the Parent Process Name (e.g., ccmsetup.exe, Microsoft.IntuneManagementAgent.exe) and exclude events where the File Hash matches the known benign hash of the deployment agent itself, rather than the suspicious implant.

• Scenario: Scheduled Antivirus or EDR Scans

  • Context: During scheduled full system scans, Enterprise Antivirus solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often spawn helper processes to analyze specific directories. If these helpers utilize a generic executable name or a specific DLL injection technique that overlaps with the Bemstour implant’s behavioral logic, they may trigger the rule during peak scan windows.
  • Filter/Exclusion: Exclude alerts occurring within the defined maintenance window (e.g., 02:00–04:00 local time) where the Process Command Line contains keywords specific to the AV vendor’s scanning engine (e.g., /scan, --full-scan) and the process owner is a known service account (e.g., NT SERVICE\DefenderSvc).

• Scenario: Admin Remote Management Sessions

  • Context: System administrators frequently use remote management tools like Ivanti, TanDEM, or standard PowerShell remoting to execute scripts on multiple