Gafgyt Trojan | SOC Hunt Feed

Hunt Hypothesis

The Gafgyt Trojan is detected through suspicious network traffic patterns indicative of command and control communication, which may suggest the presence of a botnet. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential large-scale distributed denial-of-service (DDoS) attacks.

YARA Rule

rule Gafgyt_Botnet_generic : MALW
{
meta:
description = "Gafgyt Trojan"
author = "Joan Soriano / @joanbtl"
date = "2017-05-01"
version = "1.0"
MD5 = "e3fac853203c3f1692af0101eaad87f1"
SHA1 = "710781e62d49419a3a73624f4a914b2ad1684c6a"

strings:
	$etcTZ = "/bin/busybox;echo -e 'gayfgt'"
	$s2 = "/proc/net/route"
	$s3 = "admin"
	$s4 = "root"

condition:
	$etcTZ and $s2 and $s3 and $s4
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

Source Rule

False Positive Guidance

Scenario: Legitimate scheduled job using nc (Netcat) for internal service discovery
Filter/Exclusion: Check for nc usage in known internal service discovery scripts or jobs, and exclude traffic to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
Scenario: System administrator using nc to test network connectivity or port availability
Filter/Exclusion: Exclude traffic originating from admin accounts (e.g., user_id = "root", user_id = "admin") or from known admin workstations (e.g., src_ip = "10.10.10.10")
Scenario: Use of nc in a CI/CD pipeline for artifact transfer or deployment testing
Filter/Exclusion: Exclude traffic associated with CI/CD pipelines (e.g., process_name = "jenkins", process_name = "gitlab-runner") or traffic to known internal artifact servers (e.g., dst_ip = "10.20.30.40")
Scenario: Network monitoring tool using nc to probe open ports on internal hosts
Filter/Exclusion: Exclude traffic from known monitoring tools (e.g., process_name = "nmap", process_name = "tcpdump") or traffic to internal network scanning targets (e.g., dst_ip = "10.0.0.0/24")
Scenario: Use of nc in a legitimate remote management tool for secure remote access
Filter/Exclusion: Exclude traffic from remote management tools (e.g., process_name = "ssh", `process_name = “r