Iron Panda malware DnsTunClient - file named.exe

Hunt Hypothesis

The detection identifies the presence of the Iron Panda malware’s DnsTunClient component, a critical tool used for covert C2 communication. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats leveraging DNS tunneling for data exfiltration and command and control.

YARA Rule

rule IronPanda_DNSTunClient 
{

    meta:
        description = "Iron Panda malware DnsTunClient - file named.exe"
        author = "Florian Roth"
        reference = "https://goo.gl/E4qia9"
        date = "2015-09-16"
        score = 80
        hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"

    strings:
        $s1 = "dnstunclient -d or -domain <domain>" fullword ascii
        $s2 = "dnstunclient -ip <server ip address>" fullword ascii
        $s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
        $s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
        $s5 = "taskkill /im conime.exe" fullword ascii
        $s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" fullword ascii
        $s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
        $s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
        $s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
        $s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
        $s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii

    condition:
        ( uint16(0) == 0x5a4d and filesize < 400KB and 2 of them ) or 5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

References

• https://goo.gl/E4qia9
• Source Rule

False Positive Guidance

• Scenario: Legitimate DNS Tunneling Tool Usage
  Description: A security team is using a legitimate DNS tunneling tool like dnsmasq or nslookup for network diagnostics or testing.
  Filter/Exclusion: Check for known DNS tunneling tools in the file name or process name, and exclude processes running from trusted directories like /usr/bin or C:\Windows\System32.

• Scenario: Scheduled System Maintenance Task
  Description: A scheduled task is running a legitimate .exe file (e.g., schtasks.exe or task scheduler) to perform system maintenance or updates.
  Filter/Exclusion: Exclude processes initiated by the Task Scheduler or with a command line that includes -s or -t flags indicating scheduled execution.

• Scenario: Admin Debugging or Forensic Analysis
  Description: An administrator is using a tool like Process Explorer or Procmon to debug or analyze system behavior.
  Filter/Exclusion: Exclude processes with a command line containing -log or -debug, or running from directories like C:\Windows\System32\wbem or C:\Program Files\Microsoft.

• Scenario: Antivirus or EDR Tool Behavior
  Description: A legitimate endpoint protection tool (e.g., Microsoft Defender, Bitdefender, or Kaspersky) is performing a scan and creating temporary files with .exe extensions.
  Filter/Exclusion: Exclude processes with known antivirus or EDR tool names in the process name or command line, or running from their installation directories.

• Scenario: PowerShell Script Execution
  Description: A PowerShell script is being run that temporarily creates or executes an .exe file as part of a legitimate automation task (e.g., deploying patches or configuration changes).
  Filter/Exclusion: