Detects Turla malware (based on sample used in the RUAG APT case)

Hunt Hypothesis

The hypothesis is that the detection identifies potential Turla malware activity associated with the RUAG APT group, leveraging specific indicators observed in the malware sample. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced persistent threats that may be operating undetected within their environment.

YARA Rule

rule Turla_APT_Malware_Gen3 
{

    meta:
        description = "Detects Turla malware (based on sample used in the RUAG APT case)"
        author = "Florian Roth"
        family = "Turla"
        reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
        date = "2016-06-09"
        hash1 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
        hash2 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
        hash3 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
        hash4 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
        hash5 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
        hash6 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
        hash7 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
        hash8 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
        hash9 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
  
    strings:
        $x1 = "\\\\.\\pipe\\sdlrpc" fullword ascii
        $x2 = "WaitMutex Abandoned %p" fullword ascii
        $x3 = "OPER|Wrong config: no port|" fullword ascii
        $x4 = "OPER|Wrong config: no lastconnect|" fullword ascii
        $x5 = "OPER|Wrong config: empty address|" fullword ascii
        $x6 = "Trans task %d obj %s ACTIVE fail robj %s" fullword ascii
        $x7 = "OPER|Wrong config: no auth|" fullword ascii
        $x8 = "OPER|Sniffer '%s' running... ooopppsss...|" fullword ascii
        $s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Post Platform" fullword ascii
        $s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Pre Platform" fullword ascii
        $s3 = "www.yahoo.com" fullword ascii
        $s4 = "MSXIML.DLL" fullword wide
        $s5 = "www.bing.com" fullword ascii
        $s6 = "%s: http://%s%s" fullword ascii
        $s7 = "/javascript/view.php" fullword ascii
        $s8 = "Task %d failed %s,%d" fullword ascii
        $s9 = "Mozilla/4.0 (compatible; MSIE %d.0; " fullword ascii
   
    condition:
        ( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 6 of ($s*) ) ) or ( 10 of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 17 string patterns in its detection logic.

References

False Positive Guidance

Scenario: A system administrator is using Microsoft Sysinternals Process Explorer to investigate a suspicious process during routine system monitoring.
Filter/Exclusion: Check for the presence of Process Explorer.exe in the process name or use a filter for processes initiated by the administrator’s user account.
Scenario: A Windows Scheduled Task is configured to run a legitimate script that uses the curl or wget command to download updates from an internal repository.
Filter/Exclusion: Exclude processes that match known internal update URLs or filter by the task name containing “update” or “patch”.
Scenario: A Microsoft Endpoint Configuration Manager (MECM) agent is performing a software inventory scan and is accessing internal network shares.
Filter/Exclusion: Exclude processes that are associated with the MECM service or have a file path matching the MECM installation directory.
Scenario: A Windows Defender Antivirus scan is initiated, and the scan engine is accessing system directories to perform a full system scan.
Filter/Exclusion: Exclude processes that are associated with MsMpEng.exe or have a command line containing “full scan” or “scan”.
Scenario: A PowerShell script is being run by a system administrator to automate the deployment of a legitimate application, and it is using Invoke-WebRequest to download the application from an internal server.
Filter/Exclusion: Exclude processes that have a command line containing Invoke-WebRequest and are initiated from a known admin account or script location.