Detects AES decryptor used by Sindoor dropper related to APT 36

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the Sindoor dropper’s AES decryption mechanism, a signature behavior associated with APT 36 campaigns that often precedes advanced payload execution. SOC teams should proactively search for this activity in Azure Sentinel to identify early-stage intrusions and mitigate potential data exfiltration or lateral movement before the attacker establishes persistence.

YARA Rule

rule MAL_Sindoor_Decryptor_Aug25 {
   meta:
      description = "Detects AES decryptor used by Sindoor dropper related to APT 36"
      author = "Pezier Pierre-Henri"
      date = "2025-08-29"
      score = 80
      reference = "Internal Research"
      hash = "9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b"
      id = "3c0c5217-b125-51a3-8129-30af5f0c7263"
   strings:
      $s1 = "Go build"
      $s2 = "main.rc4EncryptDecrypt"
      $s3 = "main.processFile"
      $s4 = "main.deriveKeyAES"
      $s5 = "use RC4 instead of AES"
   condition:
      filesize < 100MB
      and (
         uint16(0) == 0x5a4d // Windows
         or uint32be(0) == 0x7f454c46  // Linux
         or (uint32be(0) == 0xcafebabe and uint32be(4) < 0x20)  // Universal mach-O App with dont-match-java-class-file hack
         or uint32(0) == 0xfeedface  // 32-bit mach-O
         or uint32(0) == 0xfeedfacf  // 64-bit mach-O
      )
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects AES decryptor used by Sindoor dropper related to APT 36” rule, including tailored filters and exclusions:

• Scenario: Microsoft Defender Antivirus Real-Time Scanning

  • Context: The MsMpEng.exe process (Microsoft Defender) frequently utilizes AES-256 encryption routines to decrypt and scan compressed archives or encrypted email attachments in real-time. This behavior mimics the specific decryption signature of the Sindoor dropper.
  • Suggested Filter/Exclusion: Create a rule exclusion for the parent process MsMpEng.exe when it performs file I/O operations on standard user document folders (e.g., C:\Users\*\Documents, C:\Users\*\Downloads). Exclude events where the command line contains keywords like /scan or /archive.

• Scenario: Scheduled Backup Jobs via Veeam Agent

  • Context: Enterprise backup agents, such as VeeamAgent.exe or vssvc.exe, often encrypt data streams using AES before writing to disk during nightly scheduled maintenance windows. The cryptographic signature of these operations can trigger the Sindoor detection logic.
  • Suggested Filter/Exclusion: Implement a time-based filter to exclude alerts generated between 01:00 and 05:00 local time for processes running under the SYSTEM or specific backup service accounts (e.g., NT SERVICE\VeeamAgent). Additionally, exclude paths matching known backup repository directories like D:\VeeamBackup\.

• Scenario: OneDrive/SharePoint Sync Client Operations

  • Context: The Microsoft OneDrive sync client (OneDrive.exe) utilizes AES encryption to handle file synchronization and conflict resolution for enterprise users. When syncing large encrypted folders, the client invokes decryption routines that align with the