PrikormkaDropper

Hunt Hypothesis

This detection identifies adversary activity where a malicious dropper executes to stage additional payloads, leveraging the PrikormkaDropper YARA signature to capture early-stage infection indicators. Proactively hunting for this behavior in Azure Sentinel is essential to uncover stealthy initial access vectors that may evolve into more severe threats before they trigger high-severity alerts.

YARA Rule

rule PrikormkaDropper
{
    meta:
        id = "a31f8050-360d-5057-875c-64ba6b7ac79c"
    strings:
        $kd1 = "KDSTORAGE" wide
        $kd2 = "KDSTORAGE_64" wide
        $kd3 = "KDRUNDRV32" wide
        $kd4 = "KDRAR" wide

        $bin1 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
        $bin2 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
        $bin3 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}

        $inj1 = "?AVCinj2008Dlg@@" ascii
        $inj2 = "?AVCinj2008App@@" ascii
    condition:
        uint16(0) == 0x5a4d and ((any of ($bin*)) or (3 of ($kd*)) or (all of ($inj*)))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PrikormkaDropper detection rule in an enterprise environment, along with suggested filters:

• Scenario: Scheduled Antivirus Definition Updates via PowerShell

  • Context: Enterprise endpoints often run scheduled tasks (e.g., Update-DefenderExclusion) that download and execute new definition signatures using PowerShell. The PrikormkaDropper logic may flag the temporary download of a .cab or .zip file followed by an immediate execution as suspicious dropper behavior, especially if the script runs under the SYSTEM account.
  • Filter/Exclusion: Exclude processes where the parent process is WindowsUpdate.exe or MsMpEng.exe, and the command line contains keywords like /download or /update. Additionally, whitelist specific scheduled task GUIDs known to handle AV updates (e.g., {A809A340-5D67-42E1-BF3C-C3B0F8E12345}).

• Scenario: Deployment of Internal Tools via SCCM/Intune

  • Context: When System Center Configuration Manager (SCCM) or Microsoft Intune pushes a new internal utility (e.g., a custom “Prikormka” helper tool for asset tagging), the deployment agent often drops a temporary executable to %TEMP% before launching it. This mimics the classic dropper pattern of writing a file and executing it immediately, triggering the YARA rule.
  • Filter/Exclusion: Create an exclusion based on the file path location (e.g., C:\Windows\CCM\Logs or C:\ProgramData\Microsoft\IntuneManagementExtension). Furthermore, filter out events where the process image name matches known deployment agents like ccmsetup.exe, TaskHostW.exe, or `Device