beria v007 public WIP symbiont h additional

Hunt Hypothesis

This hypothesis targets the presence of the “beria” symbiont malware variant, which is known to inject into legitimate processes to establish persistence and evade standard endpoint detection. Proactively hunting for this low-severity indicator in Azure Sentinel allows the SOC to identify stealthy, low-noise compromises that may be leveraging the Azure AD or hybrid identity infrastructure before they escalate to more impactful data exfiltration or lateral movement.

YARA Rule

rule beria_v007_public_WIP_symbiont_h_additional: PEiD
{
    strings:
        $a = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer is running a local build pipeline or CI/CD agent (e.g., Jenkins, GitLab Runner, or Azure DevOps) that compiles a C++ or C# project containing the “symbiont” library or module. The resulting executable or intermediate object files may contain the specific byte sequences or string patterns targeted by the YARA rule, especially if the build is performed on a developer workstation or a build agent that is not fully isolated from the SOC scope.

  • Filter/Exclusion: Exclude processes originating from known build tools (e.g., msbuild.exe, dotnet.exe, java.exe for Gradle/Maven, or node.exe for npm builds) and files located in standard build directories (e.g., \bin\, \obj\, \build\, \target\).

• Scenario: An IT administrator is deploying or updating a custom internal application or agent that incorporates the “beria” or “symbiont” framework as a dependency. During the installation or update process, the installer (e.g., msiexec.exe, setup.exe, or a custom PowerShell script) writes the binary to disk, which may temporarily match the YARA signature before it is fully integrated or registered in the software inventory.

  • Filter/Exclusion: Exclude file writes initiated by standard installers (msiexec.exe, setup.exe, install.exe) or known deployment tools (wsus, SCCM, Intune) and limit the scope to files in application installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) rather than user profile or temp directories.

• Scenario: A data science or AI/ML team is running a Python or Jupyter notebook environment that loads a custom Python package or shared library (.dll