AntiDote12DLLDemoSISTeam

Hunt Hypothesis

This detection identifies the execution of a specific DLL demonstration file associated with the AntiDote12 tool, which may indicate legitimate software testing or potential reconnaissance activity by an adversary leveraging custom payloads. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to distinguish between benign internal development artifacts and anomalous lateral movement attempts that could serve as a precursor to more complex attack chains.

YARA Rule

rule AntiDote12DLLDemoSISTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 [4] 60 BE [4] 8D BE [4] 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the AntiDote12DLLDemoSISTeam YARA rule, including tailored filters and exclusions:

• Scenario: Microsoft Office Add-in Deployment via Group Policy

  • Context: The rule triggers when the msiexec.exe process installs a specific DLL-based add-in for Microsoft Teams or Outlook during a scheduled GPO refresh. The YARA signature matches the embedded demo DLL within the Office installation package, mistaking it for a suspicious injection.
  • Filter/Exclusion: Exclude processes where the parent is msiexec.exe and the file path contains \Microsoft Office\root\Office16\. Additionally, add an exclusion for the specific SHA256 hash of the known good installer package used in the enterprise environment.

• Scenario: Scheduled Antivirus Engine Update

  • Context: During nightly maintenance windows, the endpoint protection agent (e.g., CrowdStrike Falcon or Microsoft Defender) updates its signature database. The update mechanism loads a temporary DLL containing demo telemetry logic that matches the AntiDote12 pattern before being unloaded.
  • Filter/Exclusion: Create a time-based exclusion window for the rule between 01:00 and 04:00 UTC, or filter out alerts where the parent process is C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe (or equivalent for your specific AV vendor).

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: The DevOps team uses Azure DevOps or Jenkins to deploy a new version of an internal collaboration tool. The deployment script extracts a demo DLL into the C:\ProgramData\SIS\ directory for validation before full rollout, triggering the rule on the build agent servers.
  • Filter/Exclusion: Exclude alerts