Detects Sindoor downloader related to APT 36

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the Sindoor downloader tool associated with APT 36 to establish initial footholds and deploy secondary payloads within Azure environments. Proactive hunting for this specific indicator is essential in Azure Sentinel to identify early-stage intrusion activities before they escalate into broader compromise scenarios, given the critical severity of APT 36’s operational patterns.

YARA Rule

rule MAL_Sindoor_Downloader_Aug25 {
   meta:
      description = "Detects Sindoor downloader related to APT 36"
      author = "Pezier Pierre-Henri"
      date = "2025-08-29"
      score = 80
      reference = "Internal Research"
      hash = "38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4"
      id = "c1188abc-2bea-5cbc-a39d-9690626c0821"
   strings:
      $s1 = "Go build"
      $s2 = "main.downloadFile.deferwrap"
      $s3 = "main.decrypt"
      $s4 = "main.HiddenHome"
      $s5 = "main.RealCheck"
   condition:
      filesize < 100MB
      and (
         uint16(0) == 0x5a4d // Windows
         or uint32be(0) == 0x7f454c46  // Linux
         or (uint32be(0) == 0xcafebabe and uint32be(4) < 0x20)  // Universal mach-O App with dont-match-java-class-file hack
         or uint32(0) == 0xfeedface  // 32-bit mach-O
         or uint32(0) == 0xfeedfacf  // 64-bit mach-O
      )
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the Sindoor Downloader (APT 36) detection rule, including suggested filters and exclusions:

• Legitimate Software Deployment via SCCM/Intune

  • Scenario: The System Center Configuration Manager (SCCM) or Microsoft Intune agent executes a scheduled deployment task that downloads the “Sindoor” security suite installer package to endpoints. This often occurs during off-hours maintenance windows where the downloader service initiates a large file transfer matching the rule’s signature.
  • Filter/Exclusion: Exclude processes running under the ccmsetup.exe or Microsoft.IntuneManagementAgent.exe parent process, specifically when the download destination path matches the standard software distribution folder (e.g., C:\Windows\CCMCache\).

• Automated Patch Management by WSUS

  • Scenario: The Windows Server Update Services (WSUS) client service (wuauserv) triggers a background update cycle that pulls down specific security definitions or the Sindoor agent itself. This activity generates network traffic and file creation events identical to the APT 36 downloader behavior, particularly when the “Sindoor” package is listed as a critical update in the WSUS catalog.
  • Filter/Exclusion: Create an exclusion for the wuauserv service context where the user account is NT AUTHORITY\SYSTEM, and filter out events occurring within the defined maintenance window (e.g., 02:00 – 04:00 local time).

• Third-Party Antivirus Definition Sync

  • Scenario: An enterprise endpoint protection suite (such as CrowdStrike, SentinelOne, or Symantec) performs a scheduled definition update. The vendor’s updater service utilizes the “Sindoor” protocol or naming convention for its downloader component to fetch threat intelligence feeds,