← Back to SOC feed Coverage →

Identifies KeyBase aka Kibex.

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-17T23:00:00Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that the detection rule identifies potential KeyBase (Kibex) adversary activity by monitoring for suspicious behavior associated with this threat group. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect early-stage reconnaissance or initial access attempts by KeyBase operatives.

YARA Rule

rule MALW_KeyBase
{
meta:
	description = "Identifies KeyBase aka Kibex."
	author = "@bartblaze"
	date = "2019-02"
	tlp = "White"

strings:	
	$s1 = " End:]" ascii wide
	$s2 = "Keystrokes typed:" ascii wide
	$s3 = "Machine Time:" ascii wide
	$s4 = "Text:" ascii wide
	$s5 = "Time:" ascii wide
	$s6 = "Window title:" ascii wide
	
	$x1 = "&application=" ascii wide
	$x2 = "&clipboardtext=" ascii wide
	$x3 = "&keystrokestyped=" ascii wide
	$x4 = "&link=" ascii wide
	$x5 = "&username=" ascii wide
	$x6 = "&windowtitle=" ascii wide
	$x7 = "=drowssap&" ascii wide
	$x8 = "=emitenihcam&" ascii wide

condition:
	uint16(0) == 0x5a4d and (
		5 of ($s*) or 6 of ($x*) or
		( 4 of ($s*) and 4 of ($x*) )
	)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 14 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_KeyBase.yar