Detects RegPhantom, a kernel-mode rootkit that allow attacker to inject arbitrary code from unprivileged user-mode into

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the RegPhantom kernel-mode rootkit to stealthily inject and execute arbitrary code by bridging unprivileged user-mode processes with privileged kernel operations. Proactive hunting for this behavior in Azure Sentinel is essential due to its critical severity, as it enables attackers to bypass traditional security controls and establish persistent, hard-to-detect footholds within the operating system core.

YARA Rule

rule MAL_Kernel_RegPhantom_Mar26 {
   meta:
      description = "Detects RegPhantom, a kernel-mode rootkit that allow attacker to inject arbitrary code from unprivileged user-mode into kernel-mode and execute it."
      author = "Pezier Pierre-Henri (Nextron Systems)"
      date = "2026-03-19"
      reference = "Internal Research"
      hash = "006e08f1b8cad821f7849c282dc11d317e76ce66a5bcd84053dd5e7752e0606f"
      score = 80
      id = "aa8963b5-3053-52a4-a84f-2fc02d03275e"
   strings:
      $s1 = "CmRegisterCallback" fullword
      $s2 = "PsSetCreateThreadNotifyRoutine" fullword

      $o1 = {
         // xor decrypt
         48 8b 09     // mov     rcx, [rcx]
         0f b6 14 08  // movzx   edx, byte ptr [rax+rcx]
         4c 31 c2     // xor     rdx, r8
         88 14 08     // mov     [rax+rcx], dl
      }
      $o2 = {
         // Command selector
         c6 01 01     // mov     byte ptr [rcx], 1
         48 83 38 77  // cmp     qword ptr [rax], 77h
         0f 94 c0     // setz    al
         24 01        // and     al, 1
      }
   condition:
      uint16(0) == 0x5a4d
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

False Positive Scenarios for “RegPhantom” Detection Rule

• Scenario: Legitimate Kernel Driver Installation via Group Policy

  • Context: During enterprise-wide security updates, the IT team deploys new kernel-mode drivers (e.g., CrowdStrike Falcon Sensor or Microsoft Defender Antivirus updates) using Active Directory Group Policy. These installations often involve user-mode services injecting code into the kernel to register hooks, which mimics the rootkit’s injection behavior.
  • Filter/Exclusion: Exclude processes where ProcessName matches known security agents (e.g., CnsNotify.exe, MsMpEng.exe) and the parent process is gpupdate.exe or msiexec.exe. Additionally, filter out events where the injected module hash matches a signed certificate from trusted vendors (Microsoft, CrowdStrike).

• Scenario: Scheduled Maintenance for Virtualization Hypervisors

  • Context: In environments running VMware vSphere or Microsoft Hyper-V, scheduled maintenance jobs often update hypervisor modules. The management service (vmware-tools.exe or vmmsvc) frequently injects code into the kernel to manage virtual machine networking and storage stacks from a user-mode context, triggering the detection logic.
  • Filter/Exclusion: Create an exclusion for processes running under the “SYSTEM” account on host machines where the parent process is a known hypervisor management tool (e.g., vmware-vmsvc.exe, vmtoolsd.exe). Filter based on specific scheduled task names like “VMware Tools Update” or “Hyper-V Host Maintenance.”

• Scenario: Endpoint Detection and Response (EDR) Policy Enforcement

  • Context: EDR solutions like SentinelOne or Carbon Black often perform real-time policy enforcement by dynamically injecting kernel extensions to monitor file system activity. When a new policy is pushed from the management console, the local agent injects code into