Detects LINE VIPER Cisco ASA malware code as part of ICMP tasking shellcode payloads.

Hunt Hypothesis

This hypothesis targets adversaries embedding malicious Cisco ASA shellcode within ICMP tasking payloads to establish covert command-and-control channels or execute initial infection routines. A proactive hunt is essential in Azure Sentinel because ICMP traffic is often whitelisted and under-scrutinized, allowing this specific malware signature to bypass standard perimeter defenses and evade detection until lateral movement occurs.

YARA Rule

rule MAL_Cisco_LINE_VIPER_ICMP_Tasking_Shellcode_Payloads {
   meta:
      author = "NCSC"
      description = "Detects LINE VIPER Cisco ASA malware code as part of ICMP tasking shellcode payloads."
      date = "2025-09-25"
      reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf"
      score = 85
      license = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
      id = "7f8df075-8ed6-5d24-9743-cf3da9a48ec4"
   strings:
      $ = {
         55 53 41 54 41 55 41 56 41 57 48 89 E5 48 83 EC 60 48
         31 C0 B9 07 00 00 00 48 8D 7D A8 F3 48 AB BF 01 00 00
         00 BE 30 00 00 00
      }
      $ = {
         49 89 C7 48 C7 C2 38 DF FF FF 64 48 8B 0A 48 8B 99 00
         01 00 00 48 89 81 00 01 00 00
      }
      $ = {
         49 8B 47 10 48 8D 55 B0 BE 01 20 01 00 4C 89 FF FF 90
         90 00 00 00 48 8B 7D B0 48 85 FF 0F 84 3C 00 00 00
      }
      $ = {
         49 8B 47 10 BE 08 20 01 00 4C 89 FF 48 8D 55 A8 FF 90
         90 00 00 00 48 8B 7D B0 49 89 7E 20 48 8B 7D A8 49 89
         7E 28
      }
   condition:
      3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

References

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule “Detects LINE VIPER Cisco ASA malware code as part of ICMP tasking shellcode payloads,” along with recommended filters and exclusions:

Scenario: Network Operations Center (NOC) engineers performing routine firmware upgrades on Cisco ASA firewalls using Cisco Prime Infrastructure or SolarWinds NPM.
- Context: During the upgrade process, the management station sends complex ICMP probes to verify shellcode integrity and tasking status of the firewall modules. The payload structure mimics the specific signature pattern identified by LINE VIPER as malware.
- Filter/Exclusion: Create a whitelist rule excluding traffic where the source IP belongs to the NOC-Management subnet (e.g., 10.50.10.0/24) and the destination is any Cisco ASA device, specifically filtering on ICMP Type 8 (Echo Request) with a payload size > 64 bytes containing the specific shellcode hash.
Scenario: Automated health checks executed by Microsoft System Center Operations Manager (SCOM) or Splunk Infrastructure Monitoring agents deployed on internal servers.
- Context: These monitoring agents periodically send custom ICMP “tasking” packets to verify the responsiveness of security gateways. The shellcode embedded in these probes is a standard industry implementation that coincidentally matches the LINE VIPER malware signature for Cisco ASA environments.
- Filter/Exclusion: Add an exclusion based on the specific User-Agent or Source Port if applicable, but primarily filter by excluding traffic originating from known monitoring server IPs (e.g., 192.168.5.10-15) where the ICMP payload contains a specific “HealthCheck” marker string in the data section.
Scenario: Scheduled nightly backup jobs utilizing Veeam Backup & Replication or **Comm