Adwind JAR PACKB

Hunt Hypothesis

This detection identifies adversary activity where malicious Java Archive (JAR) files utilize specific packing structures associated with the Adwind threat group to execute payloads within the environment. Proactively hunting for this signature in Azure Sentinel is critical because it enables the SOC team to uncover early-stage supply chain compromises or lateral movement attempts that may be missed by standard endpoint protection due to their low severity classification.

YARA Rule

rule Adwind_JAR_PACKB : binary RAT Frutas Unrecom AlienSpy {
 meta:
  author = "Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com"
  reference = "https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf"
  last_modified = "2015-11-30"
 strings:
  $c1 = "META-INF/MANIFEST.MF" ascii
  $c2 = "main/Start.class" ascii
  $a1 = "con g/con g.perl" ascii
  $b1 = "java/textito.isn" ascii
 condition:
  int16(0) == 0x4B50 and ($c1 and $c2 and ($a1 or $b1))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Adwind JAR PACKB detection rule in an enterprise environment, along with recommended filters or exclusions:

• CI/CD Pipeline Artifact Staging

  • Scenario: Automated build agents (e.g., Jenkins, GitLab CI, or Azure DevOps) frequently unpack and stage Java Archive (JAR) files during the compilation of microservices. The unpack activity often occurs on shared network drives or specific build agent nodes, mimicking suspicious lateral movement or payload extraction.
  • Filter/Exclusion: Create a rule exclusion for processes running under the context of known CI/CD service accounts (e.g., svc-jenkins, gitlab-runner) and restrict the scope to specific build server hostnames or IP subnets where no user interaction is expected.

• Enterprise Java Application Deployment

  • Scenario: System administrators or automated deployment tools (such as Ansible, Chef, or Puppet) execute scheduled tasks to update enterprise applications like SAP NetWeaver, IBM WebSphere, or Oracle WebLogic. These operations involve extracting JAR packages into the application server’s lib directories, triggering the rule during standard maintenance windows.
  • Filter/Exclusion: Exclude events where the parent process is a known deployment orchestrator (e.g., ansible-playbook.exe, chef-client) or filter by file paths matching the standard installation directory structure of major Java application servers (e.g., \Program Files\IBM\WebSphere\AppServer\).

• Antivirus and Endpoint Protection Scanning

  • Scenario: Real-time scanning engines from tools like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint periodically scan large JAR files in the %TEMP% directory or user download folders. The internal extraction mechanism