PrikormkaEarlyVersion

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying early-stage Prikormka malware variants that exhibit distinct file signatures and behavioral patterns before full maturation. Proactive hunting for these indicators within Azure Sentinel is essential to identify and contain nascent threats during their initial infection phase, thereby minimizing potential lateral movement and impact on the enterprise environment.

YARA Rule

rule PrikormkaEarlyVersion
{
    meta:
        id = "c93ef2a7-72e2-584f-beb3-95e62e020eb2"
    strings:
        $str1 = "IntelRestore" ascii fullword
        $str2 = "Resent" wide fullword
        $str3 = "ocp8.1" wide fullword
        $str4 = "rsfvxd.dat" ascii fullword
        $str5 = "tsb386.dat" ascii fullword
        $str6 = "frmmlg.dat" ascii fullword
        $str7 = "smdhost.dll" ascii fullword
        $str8 = "KDLLCFX" wide fullword
        $str9 = "KDLLRUNDRV" wide fullword
    condition:
        uint16(0) == 0x5a4d and (2 of ($str*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PrikormkaEarlyVersion detection rule, along with targeted filters and exclusions:

• Scenario: Antivirus Signature Database Updates

  • Context: Enterprise endpoint protection suites (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) frequently download new definition packs that contain early-stage malware signatures. These updates often generate temporary files in the C:\ProgramData\Microsoft\Windows Defender\Platform directory that mimic the file structure of Prikormka variants, triggering a match on the YARA signature.
  • Filter/Exclusion: Add a path-based exclusion for the antivirus installation and update directories. For Microsoft Defender, exclude paths matching C:\ProgramData\Microsoft\Windows Defender\* from the rule scope to prevent matches during scheduled definition updates (typically occurring at 03:00 AM local time).

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune often deploys internal applications that utilize early-stage installer packages. These installers may contain embedded scripts or DLLs with binary entropy and header structures similar to the Prikormka family, causing a false hit during the “Install” phase of the deployment job.
  • Filter/Exclusion: Implement an exclusion based on the process name and user context. Filter out alerts where the parent process is ccmsetup.exe (SCCM) or IntuneManagementExtension.exe, specifically when executed by the local system account (NT AUTHORITY\SYSTEM) during business hours, as these represent legitimate administrative deployment tasks.

• Scenario: Legacy Backup and Archiving Jobs

  • Context: Scheduled backup jobs using tools like Veeam Agent or Acronis Cyber Backup often create temporary staging files in network shares before compression. These staging files