Detects LINE VIPER Cisco ASA malware code as part of RSA encrypted random AES key generation.

Hunt Hypothesis

This hunt hypothesis targets adversaries executing stealthy cryptographic operations by embedding LINE VIPER Cisco ASA malware signatures within RSA-encrypted AES key generation processes to evade standard detection. A SOC team should proactively investigate this activity in Azure Sentinel because the critical severity indicates a sophisticated attack vector that could compromise secure communication channels and data integrity if left unaddressed.

YARA Rule

rule MAL_Cisco_LINE_VIPER_RSA_Enc_Random_AES_Key_Gen {
   meta:
      author = "NCSC"
      description = "Detects LINE VIPER Cisco ASA malware code as part of RSA encrypted random AES key generation."
      date = "2025-09-25"
      reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf"
      score = 85
      license = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
      id = "ef37a3cf-aab8-513b-b859-7f7704fce622"
   strings:
      $xc1 = {
         48 31 C0 49 89 06 49 89 46 08 49 83 C6 10 49 83 ED 10
         4D 85 ED 75 D8 BF 30 00 00 00
      }
      $xc2 = {
         0F 85 57 01 00 00 49 8B 44 24 08 48 83 F8 2F 7C 33 41
         BD F0 02 00 00 4D 8D 74 24 10 49 8B 3E
      }
      $xc3 = {
         85 C0 0F 8E EE 00 00 00 41 BD F0 02 00 00 4D 8D 7C 24
         10 49 8B 3F 48 85 FF 74 0D 49 83 C7 10 49 83 ED 10 4D 85 ED 75 EB
         4D 89 37 BF 70 00 00 00
      }
      $xc4 = {
         48 85 C0 0F 84 3F 00 00 00 48 89 45 B0 BF 80 00 00 00
         4C 89 EE 48 89 C2 48 8B 4D A8 41 B8 01 00 00 00
      }
   condition:
      1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the detection rule “Detects LINE VIPER Cisco ASA malware code as part of RSA encrypted random AES key generation,” along with suggested filters and exclusions:

Scenario: Scheduled SSL Certificate Renewal via OpenSSL
- Context: The enterprise’s automated certificate management tool (e.g., HashiCorp Vault or Certbot) runs a nightly cron job to generate new RSA keys and wrap them in AES-256 encryption for the web server. This process invokes openssl commands that utilize specific cryptographic libraries, which the heuristic engine misidentifies as the “LINE VIPER” malware signature due to similar byte patterns in the key generation handshake.
- Suggested Filter/Exclusion: Create an exclusion rule based on the process name (certbot.exe, vault-agent) and command line arguments containing specific flags like -newkey rsa:2048 or -aes-256-cbc. Additionally, exclude traffic originating from the dedicated Certificate Authority (CA) server IP range.
Scenario: Cisco ASA Firmware Upgrade and Configuration Backup
- Context: During a scheduled maintenance window, the Network Operations Center (NOC) team initiates a firmware upgrade on the Cisco ASA 5500-X series firewalls. The upgrade utility generates temporary RSA keys to encrypt the configuration backup file before transmission. The detection logic interprets the specific cryptographic handshake used by the Cisco management plane as the “LINE VIPER” malware code rather than standard administrative activity.
- Suggested Filter/Exclusion: Exclude alerts where the source process is identified as asa-ctrl or system-mgr and the destination port matches the Cisco management ports (e.g., UDP 162 for SNMP, TCP 443 for ASDM). A time-based filter can also be applied to