This detection identifies potential adversary activity associated with the AntiDote14SESI team by matching file artifacts against a specific YARA signature within Azure Sentinel. Proactive hunting for this indicator is essential to validate the presence of known security tools or related processes and ensure they are not being leveraged as part of a broader, low-severity reconnaissance campaign that could precede more critical attacks.
rule AntiDote14SESISTeam
{
meta:
author="malware-lu"
strings:
$a0 = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the AntiDote14SESISTeam detection rule, including suggested filters and exclusions:
Scenario: The Microsoft Endpoint Configuration Manager (SCCM) client service (ccmexec.exe) initiates a scheduled inventory scan that triggers the YARA signature while reading application manifests in the C:\Program Files directory.
C:\Windows\CCM\* and specifically filter out events where the parent process is ccmexec.exe with a command line containing “Inventory” or “SoftwareUpdate”.Scenario: The Sysinternals Process Explorer (procexp64.exe) is launched by a System Administrator to troubleshoot a service, causing the tool’s internal scanning engine to match the rule signature against system DLLs.
procexp64.exe when executed from the standard installation path C:\Program Files\Sysinternals\Process Explorer\.Scenario: The Microsoft Defender Antivirus engine (MsMpEng.exe) performs a periodic background scan of the C:\Windows\System32 directory, where the YARA rule detects legitimate system binaries that share structural similarities with the target threat.
MsMpEng.exe when the file path being scanned is within C:\Windows\System32\ or C:\Program Files\Microsoft Defender Antivirus\.Scenario: A scheduled PowerShell job (powershell.exe) running a custom deployment script executes via Task Scheduler, invoking a local build tool that matches the rule’s signature during artifact verification.