AntiDote10BetaSISTeam

Hunt Hypothesis

This rule identifies the presence of the AntiDote10BetaSISTeam malware, a low-severity threat often associated with specific intrusion sets or beta-stage implants that may establish initial footholds in the environment. Proactively hunting for this signature allows the SOC to detect early-stage compromises or dormant payloads that traditional behavioral detections might miss, ensuring timely containment before the adversary advances their operations.

YARA Rule

rule AntiDote10BetaSISTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: The SIEM team deploys a new version of the internal “AntiDote” beta agent to a subset of test VMs for performance benchmarking. The YARA rule matches the specific binary hash or string pattern of this beta build, triggering alerts on the test hosts.

  • Filter/Exclusion: Exclude hosts tagged with Environment=Test or OSGroup=BetaAgents from this specific YARA rule evaluation, or whitelist the specific SHA256 hash of the beta binary in the correlation engine.

• Scenario: A developer on the Security Engineering team runs the AntiDote10Beta CLI tool locally on their workstation to generate threat intelligence feeds or validate detection logic before pushing to production. The tool executes a short-lived process that matches the YARA signature.

  • Filter/Exclusion: Exclude processes where the parent process is a known IDE (e.g., code.exe, idea64.exe) or where the user account belongs to the SEC-ENG group, provided the process duration is less than 5 minutes.

• Scenario: An automated CI/CD pipeline job runs the AntiDote10Beta scanner as part of a nightly vulnerability assessment task on a build server. The scanner loads the beta library into memory, triggering the YARA match during the scan window.

  • Filter/Exclusion: Exclude alerts where the source IP is within the 10.20.5.0/24 (CI/CD subnet) and the process name matches anti_dote_scanner.exe or python.exe with arguments containing --run-beta-scan.

• Scenario: A system administrator manually installs the “AntiDote10Beta” feature pack on a jump host to troubleshoot a connectivity issue. The installation script extracts and runs the beta components, which remain in memory