Detects SLAPSTICK malware used by UNC2891

Hunt Hypothesis

This hunt hypothesis targets the presence of SLAPSTICK malware deployed by the UNC2891 advanced persistent threat group to identify early-stage compromise indicators within our environment. Proactively hunting for this signature in Azure Sentinel is essential due to its critical severity, enabling the SOC team to rapidly isolate affected assets and mitigate potential data exfiltration or lateral movement before broader network impact occurs.

YARA Rule

rule EXT_APT_UNC2891_SLAPSTICK {
   meta:
      author = "Mandiant"
      description = "Detects SLAPSTICK malware used by UNC2891"
      date = "2022-03-17"
      reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
      score = 80
      id = "2e97b8cb-a86e-5be9-92dc-fd1474aa9547"
   strings:
      $ss1 = { 25 59 20 25 62 20 25 64 20 25 48 3a 25 4d 3a 25 53 20 20 20 20 00 }
      $ss2 = { 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 00 }
      $ss3 = { 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 73 0a 00 }
   condition:
      (uint32(0) == 0x464c457f) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://www.mandiant.com/resources/blog/unc2891-overview
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SLAPSTICK detection rule (EXT_APT_UNC2891_SLAPSTICK), along with targeted filters and exclusions:

• Scenario: Automated Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: The SCCM client service (ccmsetup.exe) often extracts or deploys application payloads that contain generic C++ runtime libraries or compressed archives. These artifacts can structurally resemble the SLAPSTICK dropper’s file signature, particularly when deploying software updates to a large fleet of workstations during business hours.
  • Filter/Exclusion: Add an exclusion for the process path C:\Program Files\Microsoft Configuration Manager\ccmsetup.exe and its child processes. Additionally, filter alerts where the parent process is wuauserv.exe (Windows Update) if the file hash matches known good versions of the SCCM client.

• Scenario: Scheduled Backup Jobs using Veeam Agent

  • Context: Enterprise backup agents like Veeam often create temporary staging files or restore points that utilize similar compression algorithms and binary structures to SLAPSTICK. When a scheduled job runs (e.g., nightly at 02:00), the agent may spawn a helper process (VeeamAgent.exe) that generates a file matching the YARA rule’s specific byte sequence for the UNC2891 payload.
  • Filter/Exclusion: Exclude alerts triggered by VeeamAgent.exe or vbruntime64.exe running under the SYSTEM account. Implement a time-based filter to suppress detections occurring between 01:00 and 05:00 on days when backup maintenance windows are active.

• Scenario: Development Environments Running Docker Containers

  • Context: In R&D departments, developers