Detects LINE VIPER Cisco ASA malware code as part of AES encrypted tasking and exfiltration.

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging LINE VIPER Cisco ASA malware to establish command-and-control channels via AES-encrypted tasks that facilitate stealthy data exfiltration. A proactive search in Azure Sentinel is essential because this specific encryption pattern often bypasses standard network traffic analysis, requiring deep inspection of encrypted payloads to identify early-stage compromise and prevent sensitive data loss.

YARA Rule

rule MAL_Cisco_LINE_VIPER_AES_Enc_Tasking_Exfil {
   meta:
      author = "NCSC"
      description = "Detects LINE VIPER Cisco ASA malware code as part of AES encrypted tasking and exfiltration."
      date = "2025-09-25"
      reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf"
      score = 85
      license = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
      id = "9f3d77a6-3e31-588c-a65d-f1f9d9bc84df"
   strings:
      $ = {
         48 31 C0 48 89 45 D8 49 89 FC 49 89 F5 49 89 D6 48 8B
         47 08 48 89 45 B8 48 8D 40 40 48 89 45 E0 48 8D 70 E0 48 89 75 B0
         48 8D 78 F0 48 89 7D E8 BA 10 00 00 00
      }
      $ = {
         48 85 C0 0F 84 EA 00 00 00 48 89 45 A8 4C 89 EF 48 89
         C6 4C 89 F2 48 8B 4D A0 4C 8B 45 B0 4D 31 C9
      }
      $ = {
         48 85 C0 0F 84 82 00 00 00 49 89 C7 48 8B 7D E0 BE 00
         01 00 00 48 8B 55 A0
      }
      $ = {
         48 8B 7D D0 49 83 C7 10 49 C1 EF 04 49 C1 E7 04 4C 89
         FE 48 8D 55 D8
      }
   condition:
      3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “LINE VIPER Cisco ASA Malware” detection rule, along with suggested filters or exclusions:

Scenario: Automated Endpoint Protection Scans by CrowdStrike Falcon or Microsoft Defender
- Context: The EDR agent performs scheduled deep scans on critical system directories (e.g., C:\Windows\System32), generating large amounts of encrypted telemetry data that mimics the AES tasking and exfiltration patterns of the VIPER malware.
- Filter/Exclusion: Exclude processes where the executable path matches known EDR agents, such as C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe or C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe.
Scenario: Scheduled Cloud Backup Jobs via Veeam or Commvault
- Context: Enterprise backup agents (e.g., Veeam Backup & Replication) initiate nightly encrypted transfers to cloud storage (AWS S3, Azure Blob). The high-volume AES-encrypted data stream during the “exfiltration” phase triggers the rule.
- Filter/Exclusion: Create a whitelist for destination IP ranges belonging to known backup providers and exclude traffic initiated by VeeamBackupService.exe or CommServe.exe communicating with specific backup server FQDNs (e.g., backup-enterprise.corp.local).
Scenario: Software Update Deployment via Microsoft Endpoint Configuration Manager (SCCM)
- Context: During the monthly patching window, SCCM clients download large update packages over encrypted channels. The “tasking” phase involves the client requesting updates, and the “exfiltration” phase involves uploading compliance logs or telemetry back to the management point using AES encryption.
- Filter/Exclusion: Filter out events where the source process is `ccmsetup