HACKSTOPv113

Hunt Hypothesis

This rule detects the presence of the HACKSTOPv113 malware variant, which is often associated with web shell deployments or initial access footholds on Azure-hosted workloads. Proactively hunting for this signature allows the SOC team to identify dormant or low-noise intrusions before they escalate into lateral movement or data exfiltration activities.

YARA Rule

rule HACKSTOPv113
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 B8 [2] 1E CD 21 86 E0 3D [2] 73 ?? CD 20 0E 1F B4 09 E8 [2] 24 ?? EA }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer executes a legitimate build or packaging script (e.g., using msbuild, dotnet publish, or a custom Python/Node.js build tool) that creates a temporary executable or archive in a user-writable directory like %TEMP% or C:\Users\Public. The YARA rule may match common string patterns or structural artifacts in these generated files.

  • Filter/Exclusion: Exclude files located in standard build/output directories (e.g., C:\Program Files\*, C:\Users\*\AppData\Local\Temp\*, C:\Users\*\Documents\*) if the parent process is a known build tool (e.g., msbuild.exe, dotnet.exe, npm.exe, python.exe).

• Scenario: An endpoint agent or security tool (e.g., CrowdStrike Falcon, Carbon Black, or a custom EDR sensor) drops a small helper executable or configuration blob into a system or user directory during an update or policy sync. These files often contain specific byte sequences or strings that match the generic patterns in HACKSTOPv113.

  • Filter/Exclusion: Exclude files whose parent process is a known security agent (e.g., FalconSensor.exe, cb.exe, edr_agent.exe) or files located in vendor-specific directories (e.g., C:\Program Files\CrowdStrike\*, C:\Program Files\Carbon Black\*).

• Scenario: A scheduled task or service (e.g., Task Scheduler running a PowerShell script that invokes a .NET assembly, or a Java-based application like Jenkins or Tomcat) generates a temporary JAR file, DLL, or native helper in a shared network drive or local temp folder. The YARA rule may flag the file due to common library signatures or embedded strings.