Detects the backdoor Beastdoor

Hunt Hypothesis

This detection rule identifies the presence of the Beastdoor backdoor by monitoring for its specific behavioral indicators within Azure Sentinel to uncover potential unauthorized access or persistence mechanisms. Proactively hunting for this threat is essential because backdoors like Beastdoor often operate with low visibility in their early stages, allowing adversaries to establish a foothold before triggering broader incident alerts.

YARA Rule

rule Beastdoor_Backdoor {
	meta:
		description = "Detects the backdoor Beastdoor"
		author = "Florian Roth"
		score = 55
		hash = "5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a"
	strings:
		$s0 = "Redirect SPort RemoteHost RPort  -->Port Redirector" fullword
		$s1 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword
		$s2 = "http://IP/a.exe a.exe            -->Download A File" fullword
		$s7 = "Host: wwp.mirabilis.com:80" fullword
		$s8 = "%s -Set Port PortNumber              -->Set The Service Port" fullword
		$s11 = "Shell                            -->Get A Shell" fullword
		$s14 = "DeleteService ServiceName        -->Delete A Service" fullword
		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword
		$s17 = "%s -Set ServiceName ServiceName      -->Set The Service Name" fullword
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Beastdoor detection rule (Beastdoor_Back), including tailored filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Backup Agent Execution

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize a background service that establishes persistent connections to the cloud or central management server. These agents frequently spawn child processes with similar command-line arguments (e.g., --mode=sync, --target=cloud) that mimic the Beastdoor’s persistence mechanism.
  • Filter/Exclusion: Create an exclusion rule for the specific Service Name and Process Image Path of the backup agent.
    • Example: Exclude process image paths containing \Program Files\Veeam\Backup and Replication\ where the parent process is vbrsvc.exe.

• Scenario: Scheduled PowerShell Maintenance Scripts

  • Context: IT Operations teams often deploy scheduled tasks using Windows Task Scheduler to run custom PowerShell scripts for patching or log rotation. If a script invokes a remote management tool (like Ansible Tower or Puppet Agent) via powershell.exe -ExecutionPolicy Bypass, the resulting network traffic and process tree can trigger the Beastdoor logic due to similar registry key modifications or outbound connections.
  • Filter/Exclusion: Filter out events where the parent process is TaskScheduler (svchost.exe) and the command line contains specific keywords like -File "C:\Scripts\Maintenance\daily_patch.ps1".

• Scenario: Endpoint Detection and Response (EDR) Self-Defense

  • Context: Modern EDR platforms such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne run continuous background scanning engines. These engines often inject code into other