Detects RayInitiator GRUB bootkit stage 3 deploy phase code that copies LINE VIPER shellcode stub and marks executable.

Hunt Hypothesis

This rule detects a sophisticated GRUB bootkit attack where an adversary deploys the RayInitiator component to copy and mark the LINE VIPER shellcode stub as executable during the system’s stage 3 initialization phase. SOC teams should proactively hunt for this behavior in Azure Sentinel because early-stage bootkits operate below traditional OS-level security controls, making them critical to identify before they can establish persistent root access and evade standard endpoint detection mechanisms.

YARA Rule

rule MAL_Cisco_RayInitiator_Stage_3_LINE_VIPER_ShellCode {
   meta:
      author = "NCSC"
      description = "Detects RayInitiator GRUB bootkit stage 3 deploy phase code that copies LINE VIPER shellcode stub and marks executable."
      date = "2025-09-25"
      reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf"
      score = 85
      id = "91545ed8-b798-5c0c-a229-e7d37ed7d271"
   strings:
      $xc1 = {
         48 89 FA 48 83 C7 40 4C 89 CE B9 D0 01 00 00 F3 A4 48
         89 D7 48 83 C7 40 48 89 3A 48 C1 EF 0C 48 C1 E7 0C BA
         07 00 00 00 48 C7 C6 00 20 00 00
      }
   condition:
      $xc1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the RayInitiator GRUB bootkit stage 3 deploy phase detection rule, including suggested filters or exclusions:

Scenario 1: Automated OS Image Provisioning via SCCM/Intune
- Context: Enterprise Deployment Tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune often execute a “Stage 3” deployment sequence during the initial provisioning of new hardware. The RayInitiator process may be invoked by the deployment engine to copy boot configuration files and mark shellcode stubs as executable to finalize the GRUB bootloader setup before the OS fully boots.
- Filter/Exclusion: Create an exclusion for processes spawned by ccmsetup.exe (SCCM) or IntuneManagementExtension.exe. Specifically, filter out events where the parent process name matches these tools and the file path of the copied stub resides within the standard deployment staging directory (e.g., C:\Windows\CCM\Logs\Deployment).
Scenario 2: Scheduled Firmware Update Jobs
- Context: Many enterprise environments utilize scheduled tasks to push BIOS/UEFI firmware updates overnight. Tools such as Dell Command | Update, Lenovo Commercial Systems Update, or Ivanti Neurons often trigger a bootkit deployment phase during the update cycle. These tools copy security shellcode stubs (like LINE VIPER) into the GRUB configuration and set executable permissions to ensure persistence across reboots.
- Filter/Exclusion: Exclude events occurring within a specific time window (e.g., 02:00–04:00 local time) where the initiating process is dellcmd.exe, LCSU.exe, or ivanti-agent.exe. Additionally, add a condition to ignore files copied to the vendor-specific update directories (e.g., `C:\Program Files\Dell\Command Update\