Detects Turla malware (based on sample used in the RUAG APT case)

Hunt Hypothesis

The hypothesis is that the detection identifies potential Turla malware activity associated with the RUAG APT group, leveraging specific indicators observed in the sample. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced persistent threats that may be operating undetected within their environment.

YARA Rule

rule Turla_APT_Malware_Gen2 
{

    meta:
        description = "Detects Turla malware (based on sample used in the RUAG APT case)"
        author = "Florian Roth"
        family = "Turla"
        reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
        date = "2016-06-09"
        hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
        hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
        hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
        hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
  
    strings:
        $x1 = "Internal command not support =((" fullword ascii
        $x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
        $x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
        $x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
        $x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
        $x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
        $x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
        $x8 = "\\\\%s\\pipe\\comnode" fullword ascii
        $x9 = "Plugin dll stop failed." fullword ascii
        $x10 = "AS_USER:LogonUser():%d" fullword ascii
        $s1 = "MSIMGHLP.DLL" fullword wide
        $s2 = "msimghlp.dll" fullword ascii
        $s3 = "ximarsh.dll" fullword ascii
        $s4 = "msximl.dll" fullword ascii
        $s5 = "INTERNAL.dll" fullword ascii
        $s6 = "\\\\.\\Global\\PIPE\\" fullword ascii
        $s7 = "ieuser.exe" fullword ascii
    
    condition:
        ( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 5 of ($s*) ) ) or ( 10 of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 17 string patterns in its detection logic.

References

False Positive Guidance

Scenario: Legitimate system update using Turla-related tool
Description: A system update or patching process uses a tool that matches the Turla signature (e.g., turla_tool.exe) as part of a vendor’s legitimate maintenance script.
Filter/Exclusion: Exclude processes initiated by a known patch management tool (e.g., Microsoft Update, WSUS, or SCCM) or with a command-line argument indicating a scheduled update task.
Scenario: Admin task using Turla-related command-line tool
Description: A system administrator uses a legitimate command-line tool (e.g., turla_cmd.exe) that is part of a third-party enterprise toolset for configuration management or log analysis.
Filter/Exclusion: Exclude processes executed by users with administrative privileges and associated with known admin tasks (e.g., taskmgr.exe, eventvwr.exe, or PowerShell scripts with RunAs context).
Scenario: Scheduled job using Turla-related script
Description: A scheduled job (e.g., via Task Scheduler or cron) runs a script that includes a Turla-related string due to a misconfiguration or outdated library.
Filter/Exclusion: Exclude processes with a Task Scheduler parent process or those running under a known legitimate scheduled job name (e.g., DailyBackup, SystemCheck, or LogCleanup).
Scenario: Malware analysis environment testing Turla sample
Description: A security team is analyzing a Turla sample in a sandboxed or isolated environment, triggering the detection rule during analysis.
Filter/Exclusion: Exclude processes running in a sandboxed environment (e.g., Cuckoo Sandbox, FireEye Sandbox, or Honeynet) or with a parent process like `vm