Detects strings used by the Bemstour exploitation tool

Hunt Hypothesis

This detection identifies the specific string signatures associated with the Bemstour exploitation tool to uncover potential initial access or lateral movement activities by threat actors utilizing this framework. Proactively hunting for these indicators in Azure Sentinel is essential because Bemstour often serves as a precursor to broader campaign behaviors, allowing the SOC team to isolate and investigate early-stage compromises before they escalate into significant incidents.

YARA Rule

rule apt3_bemstour_strings
{
meta:

description = "Detects strings used by the Bemstour exploitation tool"
author = "Mark Lechtik"
company = "Check Point Software Technologies LTD."
date = "2019-06-25"
sha256 = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
id = "8b76e10a-040f-505e-9dff-cd0a689b121e"
strings:

$dbg_print_1 = "leaked address is 0x%llx" ascii wide
$dbg_print_2 = "========== %s ==========" ascii wide
$dbg_print_3 = "detailVersion:%d" ascii wide
$dbg_print_4 = "create pipe twice failed" ascii wide
$dbg_print_5 = "WSAStartup function failed with error: %d" ascii wide
$dbg_print_6 = "can't open input file." ascii wide
$dbg_print_7 = "Allocate Buffer Failed." ascii wide
$dbg_print_8 = "Connect to target failed." ascii wide
$dbg_print_9 = "connect successful." ascii wide
$dbg_print_10 = "not supported Platform" ascii wide
$dbg_print_11 = "Wait several seconds." ascii wide
$dbg_print_12 = "not set where to write ListEntry ." ascii wide
$dbg_print_13 = "backdoor not installed." ascii wide
$dbg_print_14 = "REConnect to target failed." ascii wide
$dbg_print_15 = "Construct TreeConnectAndX Request Failed." ascii wide
$dbg_print_16 = "Construct NTCreateAndXRequest  Failed." ascii wide
$dbg_print_17 = "Construct Trans2  Failed." ascii wide
$dbg_print_18 = "Construct ConsWXR  Failed." ascii wide
$dbg_print_19 = "Construct ConsTransSecondary  Failed." ascii wide
$dbg_print_20 = "if you don't want to input password , use server2003 version.." ascii wide

$cmdline_1 = "Command format  %s TargetIp domainname username password 2" ascii wide
$cmdline_2 = "Command format  %s TargetIp domainname username password 1" ascii wide
$cmdline_3 = "cmd.exe /c net user test test /add && cmd.exe /c net localgroup administrators test /add" ascii wide
$cmdline_4 = "hello.exe  \"C:\\WINDOWS\\DEBUG\\test.exe\"" ascii wide
$cmdline_5 = "parameter not right" ascii wide

$smb_param_1 = "browser" ascii wide
$smb_param_2 = "spoolss" ascii wide
$smb_param_3 = "srvsvc" ascii wide
$smb_param_4 = "\\PIPE\\LANMAN" ascii wide
$smb_param_5 = "Werttys for Workgroups 3.1a" ascii wide
$smb_param_6 = "PC NETWORK PROGRAM 1.0" ascii wide
$smb_param_7 = "LANMAN1.0" ascii wide
$smb_param_8 = "LM1.2X002" ascii wide
$smb_param_9 = "LANMAN2.1" ascii wide
$smb_param_10 = "NT LM 0.12" ascii wide
$smb_param_12 = "WORKGROUP" ascii wide
$smb_param_13 = "Windows Server 2003 3790 Service Pack 2" ascii wide
$smb_param_14 = "Windows Server 2003 5.2" ascii wide
$smb_param_15 = "Windows 2002 Service Pack 2 2600" ascii wide
$smb_param_16 = "Windows 2002 5.1" ascii wide
$smb_param_17 = "PC NETWORK PROGRAM 1.0" ascii wide
$smb_param_18 = "Windows 2002 5.1" ascii wide
$smb_param_19 = "Windows for Workgroups 3.1a" ascii wide

$unique_str_1 = "WIN-NGJ7GKNROVS"
$unique_str_2 = "XD-A31C2E0087B2"

condition:
    uint16(0) == 0x5a4d and (5 of ($dbg_print*) or 2 of ($cmdline*) or 1 of ($unique_str*)) and 3 of ($smb_param*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 45 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the “Detects strings used by the Bemstour exploitation tool” detection rule, along with suggested filters and exclusions:

• Scenario: Automated Backup Scripts Executing via PowerShell

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize PowerShell scripts that invoke System.Management.Automation or load specific .NET assemblies containing strings similar to the Bemstour payload. When these scripts run on scheduled tasks, they may trigger the rule due to overlapping string signatures in memory or process arguments.
  • Filter/Exclusion: Exclude processes where the executable path matches known backup service binaries (e.g., C:\Program Files\Veeam\Backup and Replication Service\vbcore.exe or C:\Program Files\Commvault\Agent\bin\cvagent.exe) AND the parent process is a recognized scheduler (e.g., svchost.exe with service name “TaskScheduler”).

• Scenario: Endpoint Protection Scanning Operations

  • Context: Major Endpoint Detection and Response (EDR) or Antivirus agents (such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) frequently inject strings into memory during real-time scanning or policy updates. The Bemstour rule may misidentify these injection patterns as exploitation attempts because both the tool and the EDR agent utilize similar .NET reflection techniques.
  • Filter/Exclusion: Create a whitelist for processes belonging to known security vendors. Filter out alerts where the ProcessName is one of: Cns.exe, MsMpEng.exe, or SentinelOneAgent.exe, provided the process integrity signature matches the vendor’s official hash.

• Scenario: Scheduled Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune