Adwind RAT

Hunt Hypothesis

This detection rule identifies the execution patterns of the Adwind Remote Access Trojan (RAT), which adversaries deploy to establish persistent command-and-control channels and exfiltrate sensitive data from endpoints. Proactively hunting for this behavior in Azure Sentinel is critical because Adwind’s low-severity signature often evades standard alerting thresholds, requiring manual correlation with process lineage and network traffic to uncover stealthy lateral movement before significant compromise occurs.

YARA Rule

rule Adwind
{
meta:
        author="Asaf Aprozper, asafa AT minerva-labs.com"
        description = "Adwind RAT"
        reference = "https://minerva-labs.com/post/adwind-and-other-evasive-java-rats"
        last_modified = "2017-06-25"
strings:
        $a0 = "META-INF/MANIFEST.MF"
        $a1 = /Main(\$)Q[0-9][0-9][0-9][0-9]/
        $PK = "PK"
condition:
        $PK at 0 and $a0 and $a1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://minerva-labs.com/post/adwind-and-other-evasive-java-rats
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Adwind RAT detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Management Software Updates

  • Scenario: Legitimate updates pushed by tools like Microsoft Endpoint Configuration Manager (MECM/SCCM), Ivanti, or Jamf Pro. These agents often modify the registry (HKLM\Software), inject DLLs into system processes, and establish persistent network connections to management servers, mimicking Adwind’s installation and persistence behaviors.
  • Filter/Exclusion: Exclude processes running under known service accounts (e.g., DOMAIN\SCCM-Service, DOMAIN\JamfAgent) or filter by specific executable paths such as C:\Program Files (x86)\Microsoft Configuration Manager\ and C:\Program Files\Ivanti.

• Scheduled Backup and Antivirus Scans

  • Scenario: Scheduled tasks executed by backup solutions like Veeam, Commvault, or enterprise EDR suites (CrowdStrike, SentinelOne) during off-hours. These jobs frequently spawn child processes, create temporary files in %TEMP%, and modify file permissions or attributes, which can trigger the “file creation” and “process injection” components of the Adwind rule.
  • Filter/Exclusion: Create an exclusion based on the parent process name (e.g., VeeamAgent.exe, csagent.exe) or filter events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where these scheduled jobs are known to run.

• Patch Management Deployment Cycles

  • Scenario: Automated patch deployment cycles using tools like WSUS, SolarWinds Patch Manager, or Ansible. During a deployment, the system may download large