The hypothesis is that the detection rule identifies potential adversary activity involving the execution of suspicious processes and drivers commonly associated with malware or persistence mechanisms. A SOC team should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage threats that may evade traditional detection methods.
YARA Rule
rule vmdetect_misc : vmdetect
{
meta:
author = "@abhinavbom"
maltype = "NA"
version = "0.1"
date = "31/10/2015"
description = "Following Rule is referenced from AlienVault's Yara rule repository.This rule contains additional processes and driver names."
strings:
$vbox1 = "VBoxService" nocase ascii wide
$vbox2 = "VBoxTray" nocase ascii wide
$vbox3 = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" nocase ascii wide
$vbox4 = "SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions" nocase ascii wide
$wine1 = "wine_get_unix_file_name" ascii wide
$vmware1 = "vmmouse.sys" ascii wide
$vmware2 = "VMware Virtual IDE Hard Drive" ascii wide
$miscvm1 = "SYSTEM\\ControlSet001\\Services\\Disk\\Enum" nocase ascii wide
$miscvm2 = "SYSTEM\\\\ControlSet001\\\\Services\\\\Disk\\\\Enum" nocase ascii wide
// Drivers
$vmdrv1 = "hgfs.sys" ascii wide
$vmdrv2 = "vmhgfs.sys" ascii wide
$vmdrv3 = "prleth.sys" ascii wide
$vmdrv4 = "prlfs.sys" ascii wide
$vmdrv5 = "prlmouse.sys" ascii wide
$vmdrv6 = "prlvideo.sys" ascii wide
$vmdrv7 = "prl_pv32.sys" ascii wide
$vmdrv8 = "vpc-s3.sys" ascii wide
$vmdrv9 = "vmsrvc.sys" ascii wide
$vmdrv10 = "vmx86.sys" ascii wide
$vmdrv11 = "vmnet.sys" ascii wide
// SYSTEM\ControlSet001\Services
$vmsrvc1 = "vmicheartbeat" ascii wide
$vmsrvc2 = "vmicvss" ascii wide
$vmsrvc3 = "vmicshutdown" ascii wide
$vmsrvc4 = "vmicexchange" ascii wide
$vmsrvc5 = "vmci" ascii wide
$vmsrvc6 = "vmdebug" ascii wide
$vmsrvc7 = "vmmouse" ascii wide
$vmsrvc8 = "VMTools" ascii wide
$vmsrvc9 = "VMMEMCTL" ascii wide
$vmsrvc10 = "vmware" ascii wide
$vmsrvc11 = "vmx86" ascii wide
$vmsrvc12 = "vpcbus" ascii wide
$vmsrvc13 = "vpc-s3" ascii wide
$vmsrvc14 = "vpcuhub" ascii wide
$vmsrvc15 = "msvmmouf" ascii wide
$vmsrvc16 = "VBoxMouse" ascii wide
$vmsrvc17 = "VBoxGuest" ascii wide
$vmsrvc18 = "VBoxSF" ascii wide
$vmsrvc19 = "xenevtchn" ascii wide
$vmsrvc20 = "xennet" ascii wide
$vmsrvc21 = "xennet6" ascii wide
$vmsrvc22 = "xensvc" ascii wide
$vmsrvc23 = "xenvdb" ascii wide
// Processes
$miscproc1 = "vmware2" ascii wide
$miscproc2 = "vmount2" ascii wide
$miscproc3 = "vmusrvc" ascii wide
$miscproc4 = "vmsrvc" ascii wide
$miscproc5 = "vboxservice" ascii wide
$miscproc6 = "vboxtray" ascii wide
$miscproc7 = "xenservice" ascii wide
$vmware_mac_1a = "00-05-69"
$vmware_mac_1b = "00:05:69"
$vmware_mac_2a = "00-50-56"
$vmware_mac_2b = "00:50:56"
$vmware_mac_3a = "00-0C-29"
$vmware_mac_3b = "00:0C:29"
$vmware_mac_4a = "00-1C-14"
$vmware_mac_4b = "00:1C:14"
$virtualbox_mac_1a = "08-00-27"
$virtualbox_mac_1b = "08:00:27"
condition:
2 of them
}This YARA rule can be deployed in the following contexts:
This rule contains 60 string patterns in its detection logic.
Scenario: System Maintenance Task via Task Scheduler
Description: A legitimate system maintenance task, such as disk cleanup or log rotation, is scheduled via Windows Task Scheduler and executes a process that matches the rule’s signature.
Filter/Exclusion: process.name == "cleanmgr.exe" or process.name == "schtasks.exe"
Scenario: Antivirus or Endpoint Protection Scan
Description: A security tool like Windows Defender, Bitdefender, or Kaspersky performs a full system scan, triggering a process that matches the rule’s detection logic.
Filter/Exclusion: process.name == "WindowsDefender.exe" or process.name == "avgscan.exe"
Scenario: Scheduled System Update or Patch Deployment
Description: A scheduled Windows Update or patch deployment via Group Policy or Windows Server Update Services (WSUS) triggers a process that matches the rule.
Filter/Exclusion: process.name == "wusa.exe" or process.name == "msiexec.exe"
Scenario: Driver Installation via Windows Update
Description: A legitimate driver update from Microsoft or a vendor is installed via Windows Update, which may involve processes that match the rule.
Filter/Exclusion: process.name == "setup.exe" or process.name == "devcon.exe"
Scenario: Admin Task via PowerShell or Command Prompt
Description: A system administrator runs a PowerShell script or command-line tool (e.g., diskpart, bcdedit, or reg.exe) that triggers the rule due to process names or behavior.
Filter/Exclusion: process.name == "powershell.exe" or process.name == "cmd.exe" with a whitelist of known admin tools.