The SType Backdoor rule detects potential adversary persistence mechanisms through suspicious process execution and network communication patterns indicative of a sophisticated backdoor. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage APT activity before it leads to data exfiltration or lateral movement.
YARA Rule
rule SType_Backdoor
{
meta:
author = "Cylance SPEAR Team"
/* Decode Function
8B 1A mov ebx, [edx]
8A 1B mov bl, [ebx]
80 EB 02 sub bl, 2
8B 74 24 08 mov esi, [esp+14h+var_C]
32 1E xor bl, [esi]
8B 31 mov esi, [ecx]
88 1E mov [esi], bl
8B 1A mov ebx, [edx]
43 inc ebx
89 1A mov [edx], ebx
8B 19 mov ebx, [ecx]
43 inc ebx
89 19 mov [ecx], ebx
48 dec eax
75 E2 jnz short loc_40EAC6
*/
strings:
$stype = "stype=info&data="
$mmid = "?mmid="
$status = "&status=run succeed"
$mutex = "_KB10B2D1_CIlFD2C"
$decode = {8B 1A 8A 1B 80 EB 02 8B 74 24 08 32 1E 8B 31 88 1E 8B 1A 43}
condition:
$stype or ($mmid and $status) or $mutex or $decode
}
This YARA rule can be deployed in the following contexts:
This rule contains 5 string patterns in its detection logic.
Scenario: Scheduled System Maintenance Task
Description: A legitimate system maintenance task, such as schtasks.exe running a scheduled job to clean temporary files or update system settings.
Filter/Exclusion: Exclude processes associated with schtasks.exe where the command line includes known maintenance tasks (e.g., cleanmgr.exe, defrag.exe, or diskcleanup.exe).
Scenario: Admin User Performing Remote Desktop Session
Description: An administrator using Remote Desktop Protocol (RDP) to access a server, which may trigger network traffic patterns similar to backdoor activity.
Filter/Exclusion: Exclude IP addresses or user accounts associated with known admin users, and filter traffic originating from internal IP ranges used for RDP.
Scenario: PowerShell Script for System Monitoring
Description: A legitimate PowerShell script used by IT staff to monitor system performance or log file activity, which may include commands resembling backdoor behavior.
Filter/Exclusion: Exclude processes with powershell.exe where the script path is known and trusted (e.g., C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe or scripts located in the C:\Scripts directory).
Scenario: Antivirus or EDR Tool Performing Full System Scan
Description: An endpoint detection and response (EDR) tool or antivirus software initiating a full system scan, which may generate network traffic or file access patterns similar to a backdoor.
Filter/Exclusion: Exclude processes associated with known EDR tools (e.g., Microsoft Defender Antivirus, CrowdStrike Falcon, or SentinelOne) and filter events during scheduled scan windows.
Scenario: Database Backup Job Execution
Description: A scheduled database backup job using tools like sqlbackup.exe or mysqldump.exe,