AntiDote1214SEDLLSISTeam

Hunt Hypothesis

This detection identifies potential malicious activity associated with the AntiDote1214 SEDLL SISE team signature, which may indicate targeted reconnaissance or early-stage lateral movement by an adversary leveraging specific YARA-defined indicators. Proactive hunting for this low-severity signal in Azure Sentinel is essential to uncover subtle threats that might be overlooked by automated alerts alone, allowing analysts to validate the context and prevent potential escalation before significant impact occurs.

YARA Rule

rule AntiDote1214SEDLLSISTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 [4] 60 BE [4] 8D BE [4] 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the AntiDote1214SEDLLSISTeam detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Microsoft Defender Antivirus Scans

  • Context: The YARA rule may trigger on the MsMpEng.exe process when it performs a scheduled full scan of the system drive. During this operation, the scanner loads various dynamic link libraries (DLLs) from the Windows System32 folder that match the signature logic of the rule.
  • Suggested Filter: Exclude events where the Process Name is MsMpEng.exe AND the User Account is NT AUTHORITY\SYSTEM. Alternatively, create a whitelist for the file path C:\Program Files\Windows Defender\MsMpEng.exe.

• Scenario: Office 365 ProPlus Background Updates

  • Context: The rule frequently flags legitimate background processes from Microsoft Office (e.g., OfficeClickToRun.exe or Groove.EXE) when they are updating the “Shared Services” component. These updates often involve loading specific DLLs related to team collaboration features that mimic the detection signature.
  • Suggested Filter: Add an exclusion for processes with a parent process of ClickToRun.exe running under the context of Microsoft Office 365. Specifically, filter out events where the File Path contains \Program Files\Microsoft Office\root\Office16\.

• Scenario: Enterprise Endpoint Management (Intune/SCCM) Deployment

  • Context: When System Center Configuration Manager (SCCM) or Microsoft Intune pushes a new application package to endpoints, the deployment agent (ccmsetup.exe or Microsoft.IntuneManagementAgent) loads configuration DLLs. The rule may misinterpret these legitimate configuration files as suspicious