Detects LINE VIPER Cisco ASA malware code as part of shellcode initial execution.

Hunt Hypothesis

This hunt hypothesis targets adversaries executing malicious shellcode that embeds specific LINE VIPER Cisco ASA malware signatures during the initial process creation phase. A proactive search is essential in Azure Sentinel to identify early-stage compromise indicators before the malware fully establishes persistence or exfiltrates sensitive data.

YARA Rule

rule MAL_Cisco_LINE_VIPER_Shellcode_Initial_Execution {
   meta:
      author = "NCSC (modifier by Florian Roth)"
      description = "Detects LINE VIPER Cisco ASA malware code as part of shellcode initial execution."
      date = "2025-09-25"
      modified = "2025-09-27"
      reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf"
      score = 85
      license = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
      id = "ca88eff7-bf0d-5959-b614-1afb6d68879e"
   strings:
      $xc1 = {
         48 8D B7 80 00 00 00 BA 00 20 00 00 [19] 48 C7 C6 00
         90 00 00 BA 07 00 00 00
      }
      // $x1 = /SI23gAAAALoAIAAA[A-Za-z0-9+\/]{26}jHxgCQAAC6BwAAA/
      // $x2 = /iNt4AAAAC6ACAAA[A-Za-z0-9+\/]{26}Ix8YAkAAAugcAAA/
      // $x3 = /IjbeAAAAAugAgAA[A-Za-z0-9+\/]{26}SMfGAJAAALoHAAAA/
      $xe1 = { 53 49 32 33 67 41 41 41 41 4c 6f 41 49 41 41 41 [26] 6a 48 78 67 43 51 41 41 43 36 42 77 41 41 41 }
      $xe2 = { 69 4e 74 34 41 41 41 41 43 36 41 43 41 41 41 [26] 49 78 38 59 41 6b 41 41 41 75 67 63 41 41 41 }
      $xe3 = { 49 6a 62 65 41 41 41 41 41 75 67 41 67 41 41 [26] 53 4d 66 47 41 4a 41 41 41 4c 6f 48 41 41 41 41 }
   condition:
      1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

False Positive Guidance

Scenario: Legitimate deployment of the Cisco Secure Firewall Management Center (FMC) or ASA Software Image Upgrade via the CLI or GUI. During the initial execution phase, the system generates shellcode to parse and apply new configuration blocks or firmware signatures that contain byte sequences identical to the LINE VIPER signature.
- Suggested Filter: Exclude processes originating from fmc-cli.exe, asa-upgrade.sh, or specific service accounts (e.g., svc-cisco-fmc) running on management servers, specifically when the parent process is a known administrative tool like Ansible Tower or Microsoft System Center Configuration Manager (SCCM).
Scenario: Execution of scheduled Cisco ASA Log Analysis and Reporting Jobs using tools like Splunk Universal Forwarder or SolarWinds NPM. These agents often inject shellcode to parse binary log streams from the ASA, which may trigger the detection due to embedded malware signatures within the parsing logic.
- Suggested Filter: Create an exclusion for processes named splunkd.exe or swagent.exe when they are reading files in directories designated for Cisco logs (e.g., C:\Cisco\ASA_Logs\) and the execution time aligns with defined maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Routine Endpoint Protection Scans performed by CrowdStrike Falcon or Symantec Endpoint Protection. The antivirus engine utilizes shellcode to analyze memory structures of the Cisco ASA virtual appliance or its associated agents, occasionally mistaking the scanning routine’s internal signature for active malware execution.
- Suggested Filter: Exclude events where the parent process is falcon.sys (CrowdStrike) or rtvscan64.exe (Symantec), and the file path contains keywords such as \Cisco\ASA\Agent\.