AdFlt2

Hunt Hypothesis

This detection identifies potential malicious activity associated with the AdFlt2 signature, which may indicate an adversary attempting to manipulate or monitor Active Directory traffic through specific file or process behaviors. Proactively hunting for this signal in Azure Sentinel allows the SOC team to uncover subtle early-stage indicators of compromise that might otherwise be missed by standard alerting thresholds, enabling faster response to targeted attacks on directory services.

YARA Rule

rule AdFlt2: Packer PEiD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE [2] AD }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the AdFlt2 detection rule in an enterprise environment, along with targeted filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: The daily update cycle of Microsoft Defender Antivirus or Symantec Endpoint Protection involves downloading signature definitions. These updates often manifest as new DLLs or executables in the ProgramData directory that match the AdFlt2 YARA signatures due to embedded filtering logic.
  • Filter/Exclusion: Exclude processes where the parent process is MsMpEng.exe (Defender) or Rtvscan64.exe (Symantec) and the file path contains \Microsoft\Antimalware\. Additionally, filter out events occurring strictly between 02:00 AM and 04:00 AM local time.

• Scenario: Group Policy Object (GPO) Application

  • Context: When a new GPO is pushed via System Center Configuration Manager (SCCM) or native Windows Server AD, the gpupdate.exe process often triggers policy scripts that load specific filtering modules into memory. These modules can be flagged by AdFlt2 as potential ad-filtering components being injected.
  • Filter/Exclusion: Create an exclusion for events where the parent process is svchost.exe (specifically the gpsvc service) and the command line contains gpupdate /target:computer.

• Scenario: Enterprise Browser Extension Deployment

  • Context: The IT team deploys a corporate ad-blocker or security extension for Google Chrome or Microsoft Edge via MDM (e.g., Intune). During the initial installation or auto-update, the browser’s sandboxed process loads filtering extensions that mimic the behavior detected by AdFlt