← Back to SOC feed Coverage →

Prikormka

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-02T11:00:00Z · Confidence: medium

Hunt Hypothesis

The Prikormka rule detects potential adversary behavior involving the use of a malicious YARA signature, which may indicate the presence of a known or emerging threat. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage attacks that may evade traditional detection methods.

YARA Rule

rule Prikormka
{
    
    meta:
        Author      = "Anton Cherepanov"
        Date        = "2016/05/10"
        Description = "Operation Groundbait"
        Source = "https://github.com/eset/malware-ioc/"
        Contact = "[email protected]"
        License = "BSD 2-Clause"
    
    condition:
        PrikormkaDropper or PrikormkaModule or PrikormkaEarlyVersion
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Prikormka.yar