CommentCrew-threat-apt1 detects potential adversary behavior involving suspicious comment-based PowerShell scripts that may be used for initial access or command and control. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage threat activity from unknown or low-severity adversaries.
YARA Rule
rule AURIGA_driver_APT1
{
meta:
author = "AlienVault Labs"
info = "CommentCrew-threat-apt1"
strings:
$s1 = "Services\\riodrv32" wide ascii
$s2 = "riodrv32.sys" wide ascii
$s3 = "svchost.exe" wide ascii
$s4 = "wuauserv.dll" wide ascii
$s5 = "arp.exe" wide ascii
$pdb = "projects\\auriga" wide ascii
condition:
all of ($s*) or $pdb
}
This YARA rule can be deployed in the following contexts:
This rule contains 6 string patterns in its detection logic.
Scenario: A system administrator is using PowerShell to generate a report for a scheduled job named DailySystemReport.
Filter/Exclusion: Check for ProcessName = "powershell.exe" and CommandLine containing "DailySystemReport" or "GenerateReport".
Scenario: A database administrator is running a SQL Server Agent Job to back up the database using SQLCMD.
Filter/Exclusion: Filter by ProcessName = "sqlcmd.exe" and CommandLine containing "BACKUP DATABASE" or `“sqlagent -?”
Scenario: A DevOps engineer is using Ansible to deploy configuration changes to a group of servers, which includes a script named config_update.sh.
Filter/Exclusion: Filter by ProcessName = "ansible-playbook" and CommandLine containing "config_update.sh" or "ansible.cfg".
Scenario: A user is manually commenting on a file using Notepad++ as part of a documentation task, and the file contains the string “Crew”.
Filter/Exclusion: Filter by ProcessName = "notepad++.exe" and CommandLine containing "Documentation" or "comment".
Scenario: A system update task is running via Task Scheduler that includes a script named update_script.bat, which contains the word “Crew” in a comment.
Filter/Exclusion: Filter by ProcessName = "cmd.exe" and CommandLine containing "update_script.bat" or "Task Scheduler".