PUNiSHER V15 FEUERRADER

Hunt Hypothesis

This YARA rule targets the PUNiSHER V15 FEUERRADER malware variant, a low-severity threat often associated with specific ransomware or wiper campaigns that may establish a foothold in Azure environments. Proactively hunting for this signature allows the SOC team to identify dormant or early-stage infections before they escalate into high-impact incidents, ensuring rapid containment within the Azure Sentinel ecosystem.

YARA Rule

rule PUNiSHER_V15_FEUERRADER: PEiD
{
    strings:
        $a = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A DevOps engineer runs a standard docker pull or kubectl apply command to deploy a new microservice, where the underlying container image or configuration file contains the string “FEUERRADER” (German for “Firewall”) as part of a documentation comment, variable name, or log tag.

  • Filter/Exclusion: Exclude processes where the parent process is docker.exe, kubectl.exe, or containerd.exe, and the file path resides within standard container registry cache directories (e.g., C:\ProgramData\Docker\, C:\Users\<user>\.docker\).

• Scenario: An IT administrator uses a custom PowerShell script to audit firewall rules on Windows Server 2019/2022, specifically querying Get-NetFirewallRule or parsing netsh advfirewall output, where the script or its temporary log file contains the literal string “PUNiSHER_V15” or “FEUERRADER” as a test case identifier or legacy naming convention.

  • Filter/Exclusion: Exclude events where the process is powershell.exe or pwsh.exe and the command line arguments contain Get-NetFirewallRule, netsh advfirewall, or firewall (case-insensitive), and the working directory is within C:\Scripts\ or C:\Admin\.

• Scenario: A QA engineer executes a penetration testing tool (e.g., nmap, masscan, or a custom Python script) to validate firewall configurations, where the tool’s configuration file or output log explicitly references “FEUERRADER” as a label for the firewall component being tested, triggering the YARA match on the file content.

  • Filter/Exclusion: Exclude processes where the parent process is python.exe, `nmap