Detects RayInitiator GRUB bootkit stage 1 code that searches for the 'Booting the kernel' string.

Hunt Hypothesis

This detection identifies the initial activity of a RayInitiator GRUB bootkit as it scans for the “Booting the kernel” string to establish persistence at the firmware level before the operating system fully loads. Proactive hunting in Azure Sentinel is critical because this early-stage infection can evade traditional endpoint security controls, allowing adversaries to maintain undetected access and execute malicious code during every system reboot.

YARA Rule

rule MAL_Cisco_RayInitiator_Stage_1 {
   meta:
      author = "NCSC"
      description = "Detects RayInitiator GRUB bootkit stage 1 code that searches for the 'Booting the kernel' string."
      date = "2025-09-25"
      reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf"
      score = 85
      license = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
      id = "5631f2c5-5141-5039-9cd0-a35314aa0bd5"
   strings:
      $xc1 = {
         BB 00 00 40 00 43 81 FB 00 00 60 00 0F 87 AB 00 00 00
         8B 3B 81 FF 64 6F 6E 65 75 E9 83 C3 04 8B 3B 81 FF 2E 0A 42 6F 75
         DC 83 C3 04 8B 3B 81 FF 6F 74 69 6E 75 CF 83 C3 04 8B 3B 81 FF 67
         20 74 68 75 C2 83 C3 04 8B 3B 81 FF 65 20 6B 65 75 B5 83 C3 04 8B
         3B 81 FF 72 6E 65 6C 75 A8 83 EB 14
      }
   condition:
      $xc1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the RayInitiator GRUB bootkit detection rule, including suggested filters and exclusions:

• Scenario: Automated OS Patching via Microsoft SCCM or Ansible

  • Context: During scheduled maintenance windows, enterprise patch management tools (e.g., SCCM, Ansible Tower) often trigger a system reboot to apply kernel updates. The GRUB bootloader executes its standard initialization sequence, searching for the “Booting the kernel” string as part of the normal boot flow before handing control to the OS.
  • Filter/Exclusion: Exclude events where the source process is sccm.exe (Configuration Manager) or ansible-runner and the event timestamp falls within a defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Virtual Machine Snapshot or Cloning Operations

  • Context: When administrators perform live snapshots of VMs using tools like VMware vCenter or Hyper-V Manager, the hypervisor may trigger a brief boot sequence check on the guest OS to verify disk state. This action invokes the GRUB stage 1 code, generating the specific string search signature without indicating an actual malicious bootkit injection.
  • Filter/Exclusion: Filter out alerts where the host machine type is identified as “Virtual Machine” and the triggering process belongs to hypervisor management daemons (e.g., vmware-tools.exe, vmsvc).

• Scenario: Post-Installation Configuration Scripts

  • Context: During the provisioning of new servers via image deployment tools like Puppet or Chef, a custom post-installation script often runs immediately after the first boot. This script may re-query GRUB configuration files to verify kernel parameters, causing the “Booting the kernel” string search logic to execute as part of the validation routine rather than an attack.