Prikormka

Hunt Hypothesis

This detection identifies potential adversary reconnaissance activities where threat actors deploy custom payloads to establish initial footholds or exfiltrate data within Azure Sentinel environments. Proactive hunting for this behavior is essential because early-stage indicators often lack distinct signatures in standard logs, requiring YARA-based analysis to uncover stealthy threats before they escalate into critical incidents.

YARA Rule

rule Prikormka
{
    meta:
        Author      = "Anton Cherepanov"
        Date        = "2016/05/10"
        Description = "Operation Groundbait"
        Source = "https://github.com/eset/malware-ioc/"
        Contact = "[email protected]"
        License = "BSD 2-Clause"
        id = "6073aa34-d385-5ae8-b97d-9b3d61015aae"
    condition:
        PrikormkaDropper or PrikormkaModule or PrikormkaEarlyVersion
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Prikormka detection rule in an enterprise environment, including targeted filters and exclusions:

• Scenario: Legitimate Software Deployment via SCCM/Intune

  • Context: The Prikormka logic often flags the initial execution of new application packages during mass deployment windows. When System Center Configuration Manager (SCCM) or Microsoft Intune pushes a new update to endpoint agents, the installation process involves spawning temporary scripts and modifying registry keys that mimic the rule’s signature for lateral movement or payload delivery.
  • Filter/Exclusion: Create an exclusion based on the CommandLine containing specific deployment identifiers (e.g., ccmsetup.exe, Microsoft.IntuneManagement) and restrict the alert to non-business hours if deployments are scheduled nightly. Alternatively, whitelist the hash of the SCCM client agent (CcmExec.exe).

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise antivirus solutions like CrowdStrike Falcon or Symantec Endpoint Protection frequently download and install definition updates via background services. These processes often involve writing to specific system directories and executing verification scripts that trigger the Prikormka YARA rule, which may interpret these file writes as suspicious data staging.
  • Filter/Exclusion: Exclude processes originating from known AV vendors (e.g., C:\Program Files\CrowdStrike\fsq.exe or Symantec\rtvscan64.exe). Add a filter to suppress alerts where the parent process is the OS Update service (usoc_dla.exe) during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Automated Backup and Archiving Jobs

  • Context: Scheduled backup agents such as Veeam Agent or Rubrik often compress large datasets and move them to network