Detects malware from OilRig Campaign

Hunt Hypothesis

Adversaries associated with the OilRig campaign may use custom malware to establish persistence and exfiltrate data, which could indicate a targeted compromise. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential long-term threats from advanced persistent threats.

YARA Rule

rule OilRig_Malware_Campaign_Mal3 
{

   meta:
      description = "Detects malware from OilRig Campaign"
      author = "Florian Roth"
      reference = "https://goo.gl/QMRZ8K"
      date = "2016-10-12"
      hash1 = "02226181f27dbf59af5377e39cf583db15200100eea712fcb6f55c0a2245a378"

   strings:
      $x1 = "(Get-Content $env:Public\\Libraries\\dns.ps1) -replace ('#'+'##'),$botid | Set-Content $env:Public\\Libraries\\dns.ps1" fullword ascii
      $x2 = "Invoke-Expression ($global:myhome+'tp\\'+$global:filename+'.bat > '+$global:myhome+'tp\\'+$global:filename+'.txt')" fullword ascii
      $x3 = "('00000000'+(convertTo-Base36(Get-Random -Maximum 46655)))" fullword ascii

   condition:
      ( filesize < 10KB and 1 of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://goo.gl/QMRZ8K
• Source Rule

False Positive Guidance

• Scenario: Legitimate scheduled backup job using Veeam Backup & Replication
  Filter/Exclusion: Exclude processes initiated by Veeam Backup or with command lines containing veeam or backup.

• Scenario: System update using Windows Update or WSUS
  Filter/Exclusion: Exclude processes with wuau in the command line or associated with Windows Update services.

• Scenario: Admin task using PowerShell to configure system settings
  Filter/Exclusion: Exclude PowerShell scripts executed by LocalSystem or with powershell.exe in the command line and no suspicious arguments.

• Scenario: Network monitoring tool like Wireshark capturing traffic
  Filter/Exclusion: Exclude processes with wireshark.exe or tshark in the command line, or running under a non-admin user.

• Scenario: Legitimate remote management using Microsoft Remote Desktop Services
  Filter/Exclusion: Exclude processes associated with mstsc.exe or running under a user account with Remote Desktop User privileges.