PrikormkaModule

Hunt Hypothesis

This detection identifies the presence of the specific “PrikormkaModule” payload within the environment to uncover potential early-stage adversary activity or benign software deployment. Proactively hunting for this module in Azure Sentinel allows the SOC team to validate its legitimacy and establish a baseline, ensuring that any anomalous behavior associated with this component is identified before it escalates into a significant security incident.

YARA Rule

rule PrikormkaModule
{
    meta:
        id = "69b1414d-6068-5d3e-8727-c63619c305b5"
    strings:
        // binary
        $str1 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
        $str2 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
        $str3 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
        $str4 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
        $str5 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
        $str6 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
        $str7 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}

        // encrypted
        $str8 = {50 52 55 5C 17 51 58 17 5E 4A}
        $str9 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
        $str10 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
        $str11 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
        $str12 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}

        // mutex
        $str13 = "ZxWinDeffContex" ascii wide
        $str14 = "Paramore756Contex43" wide
        $str15 = "Zw_&one@ldrContext43" wide

        // other
        $str16 = "A95BL765MNG2GPRS"

        // dll names
        $str17 = "helpldr.dll" wide fullword
        $str18 = "swma.dll" wide fullword
        $str19 = "iomus.dll" wide fullword
        $str20 = "atiml.dll"  wide fullword
        $str21 = "hlpuctf.dll" wide fullword
        $str22 = "hauthuid.dll" ascii wide fullword

        // rbcon
        $str23 = "[roboconid][%s]" ascii fullword
        $str24 = "[objectset][%s]" ascii fullword
        $str25 = "rbcon.ini" wide fullword

        // files and logs
        $str26 = "%s%02d.%02d.%02d_%02d.%02d.%02d.skw" ascii fullword
        $str27 = "%02d.%02d.%02d_%02d.%02d.%02d.%02d.rem" wide fullword

        // pdb strings
        $str28 = ":\\!PROJECTS!\\Mina\\2015\\" ascii
        $str29 = "\\PZZ\\RMO\\" ascii
        $str30 = ":\\work\\PZZ" ascii
        $str31 = "C:\\Users\\mlk\\" ascii
        $str32 = ":\\W o r k S p a c e\\" ascii
        $str33 = "D:\\My\\Projects_All\\2015\\" ascii
        $str34 = "\\TOOLS PZZ\\Bezzahod\\" ascii

    condition:
        uint16(0) == 0x5a4d and (any of ($str*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 34 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PrikormkaModule detection rule in an enterprise environment, along with suggested filters:

• Scenario: Automated Backup Agent Scans

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik frequently utilize a “feed” or ingestion module to index file metadata before archiving. During peak backup windows (e.g., 02:00–04:00 UTC), these agents spawn processes that match the PrikormkaModule signature while scanning large datasets on file servers.
  • Suggested Filter: Exclude alerts where the parent process is VeeamTransportService.exe, rubrik-agent.exe, or backupengine.exe, and restrict the rule to trigger only outside of defined maintenance windows (e.g., 02:00–04:00).

• Scenario: Endpoint Protection Content Updates

  • Context: Antivirus engines such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint often deploy a specific content update module named “Prikormka” (or similar) to ingest new threat intelligence feeds. This activity occurs daily at 09:00 local time, triggering the rule when the agent downloads and parses the new signature database.
  • Suggested Filter: Create an exclusion for events where the command line contains keywords like --update-feed, --ingest-content, or PrikormkaUpdate, specifically targeting known AV service executables (e.g., C:\Program Files\CrowdStrike\fsquarant.exe).

• Scenario: Scheduled Database Index Maintenance

  • Context: In environments running SQL Server or Oracle, a nightly scheduled job (via SQL Agent) executes an index rebuild task that includes a