Detects link files, archives and binaries that contain keywords related to AppDomain hijacking/injection a technique use

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging AppDomain hijacking (MITRE T1574) to inject malicious code into legitimate processes via link files, archives, and binaries containing specific injection keywords. Proactively hunting for these artifacts in Azure Sentinel is critical because this technique allows malware to sideload payloads that often evade traditional signature-based defenses by masquerading as trusted components.

YARA Rule

rule SUSP_AppDomainInjection_Keyword_May26 {
   meta:
      description = "Detects link files, archives and binaries that contain keywords related to AppDomain hijacking/injection a technique used by malware to sideload payloads."
      author = "Jonathan Peters (Nextron Systems)"
      date = "2026-05-27"
      reference = "https://attack.mitre.org/techniques/T1574/014/"
      hash = "eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71"
      score = 70
   strings:
      $x1 = "AppDomainInjection" ascii wide fullword
      $x2 = "AppDomainHijack" ascii wide fullword
   condition:
      (
         uint16(0) == 0x5a4d // PE
         or uint16(0) == 0x4b50 // ZIP
         or uint32(0x8000) == 0x30444301 // ISO
         or uint16(0) == 0x004c and uint32(4) == 0x00021401 // LNK
      )
      and 1 of ($x*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

MITRE ATT&CK Context

• Technique: T1574 — T1574

References

• https://attack.mitre.org/techniques/T1574/014/
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the AppDomain Hijacking/Injection detection rule, along with recommended filters and exclusions:

• Scenario: Legitimate .NET Application Deployment via CI/CD Pipelines

  • Context: Automated build agents (e.g., Jenkins, Azure DevOps) frequently deploy compiled assemblies or update configuration files containing AppDomain, AssemblyLoad, or PostAssemblyResolve keywords into shared network folders or container images. These legitimate deployment artifacts often trigger the rule because they are binary archives containing the exact injection logic used by malware.
  • Filter/Exclusion: Create an exclusion based on the source process name and user context. Exclude events where the source process is msbuild.exe, dotnet.exe, or specific CI service accounts (e.g., NT SERVICE\Jenkins) performing write operations within designated deployment directories (e.g., \\BuildServer\DropFolder).

• Scenario: Scheduled Maintenance Jobs for Enterprise Line-of-Business Applications

  • Context: Enterprise Resource Planning (ERP) or Customer Relationship Management (CRM) systems often run nightly scheduled tasks that update plugin modules. These jobs utilize PowerShell scripts or custom .NET runners to inject new business logic into the application domain, generating binaries with keywords like AppDomainSetup and ShadowCopy.
  • Filter/Exclusion: Implement a time-based filter combined with a file path exclusion. Exclude detections occurring between 02:00 and 04:00 (maintenance window) where the file path matches known application roots, such as C:\Program Files\SAP\ or D:\Oracle\Middleware.

• Scenario: Antivirus and EDR Self-Healing Mechanisms

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender often perform self