This rule detects intrinsic patterns of Amadey version 5.34

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the specific behavioral signatures of Amadey version 5.34 to execute malicious activities within cloud workloads. Proactively hunting for these intrinsic patterns in Azure Sentinel is essential due to the rule’s critical severity, enabling early detection and rapid response before potential compromise escalates.

YARA Rule

rule MAL_Win_Amadey_Jun25 {
   meta:
      author = "0x0d4y"
      description = "This rule detects intrinsic patterns of Amadey version 5.34"
      date = "2025-06-18"
      score = 80
      reference = "https://0x0d4y.blog/amadey-targeted-analysis/"
      yarahub_reference_md5 = "1db72c5832fb71b29863ccc3125137a0"
      id = "853111b8-e548-46a9-8f5a-ec8621343e0d"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      malpedia_family = "win.amadey"

   strings:
      $rc4_algorithm = { 8a 96 ?? ?? ?? ?? 0f b6 86 ?? ?? ?? ?? 03 f8 0f b6 ca 03 f9 81 e7 ff 00 00 80 79 ?? 4f 81 cf 00 ff ff ff 47 8a 87 ?? ?? ?? ?? 88 86 ?? ?? ?? ?? 46 88 97 ?? ?? ?? ?? 81 fe 00 01 00 00 7c }
      $s_MZ_PE_validation = { b8 4d 5a ?? ?? 66 39 06 0f 85 a8 01 ?? ?? 8b 7e 3c 03 fe 81 3f 50 45 00 00  }
      $s_loop_through_pe_section = { 8b 4c 24 0c 03 ce 03 4e 3c 6a ?? ff b1 08 01 ?? ?? 8b 81 0c 01 00 00 03 c6 50 8b 81 04 01 ?? ?? 03 44 24 20 50 ff 74 24 30 ff 15 f4 f0 44 00 8b 4c 24 10 0f b7 47 06 41 83 44 24 0c 28 89 4c 24 10 3b c8 }
      $s_str_decryption_algorithm = { 8b cb 0f 43 35 ?? ?? ?? ?? 2b c8 8d 04 0a 33 d2 f7 f3 }

    condition:
      uint16(0) == 0x5a4d 
      and $rc4_algorithm 
      and 2 of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://0x0d4y.blog/amadey-targeted-analysis/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Amadey version 5.34” detection rule, along with suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: The Amadey (Kaspersky Endpoint Security) service automatically downloads and installs new virus definition databases every morning at 06:00 AM via the Kaspersky Administration Center. This process triggers intrinsic pattern signatures associated with version 5.34 as it writes to disk and updates memory structures.
  • Filter/Exclusion: Create a time-based exclusion for the rule between 05:45 and 06:15 daily on all endpoints running Amadey 5.34, or exclude the specific process kavsvc.exe when the parent process is Kaspersky Update Service (wuauserv).

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: During a monthly maintenance window, System Center Configuration Manager (SCCM) or Microsoft Intune pushes a cumulative update to the Amadey agent. The installation service (msiexec.exe) launches the Amadey installer, generating intrinsic patterns that mimic version 5.34 initialization events.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmsetup.exe (SCCM) or Microsoft Intune Management Extension, and the event source corresponds to a scheduled deployment task ID associated with “Amadey Upgrade”.

• Scenario: Admin-Initiated Full System Scans

  • Context: A security administrator manually triggers a “Full Scan” from the Amadey console on a batch of 50 workstations. The scan engine loads specific heuristic modules for version 5.34, causing the detection logic to fire repeatedly as it scans