BlackHole2 Exploit Kit Detection

Hunt Hypothesis

The hypothesis is that the detection identifies potential exploitation attempts by the BlackHole2 Exploit Kit, which is commonly used to deliver malware through compromised websites. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage attacks before they lead to data exfiltration or system compromise.

YARA Rule

rule blackhole2_htm10 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "BlackHole2 Exploit Kit Detection"
   hash0 = "83704d531c9826727016fec285675eb1"
   hash1 = "103ef0314607d28b3c54cd07e954cb25"
   hash2 = "16c002dc45976caae259d7cabc95b2c3"
   hash3 = "fd84d695ac3f2ebfb98d3255b3a4e1de"
   hash4 = "c7b417a4d650c72efebc2c45eefbac2a"
   hash5 = "c3c35e465e316a71abccca296ff6cd22"
   hash2 = "16c002dc45976caae259d7cabc95b2c3"
   hash7 = "10ce7956266bfd98fe310d7568bfc9d0"
   hash8 = "60024caf40f4239d7e796916fb52dc8c"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "</body></html>"
   $string1 = "/icons/back.gif"
   $string2 = ">373K</td><td>"
   $string3 = "/icons/unknown.gif"
   $string4 = ">Last modified</a></th><th><a href"
   $string5 = "tmp.gz"
   $string6 = ">tmp.gz</a></td><td align"
   $string7 = "nbsp;</td><td align"
   $string8 = "</table>"
   $string9 = ">  - </td><td>"
   $string10 = ">filefdc7aaf4a3</a></td><td align"
   $string11 = ">19-Sep-2012 07:06  </td><td align"
   $string12 = "><img src"
   $string13 = "file3fa7bdd7dc"
   $string14 = "  <title>Index of /files</title>"
   $string15 = "0da49e042d"
condition:
   15 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 16 string patterns in its detection logic.

Source Rule

False Positive Guidance

Scenario: System update or patching tool execution
Description: Legitimate system update tools (e.g., Windows Update, SCCM, or third-party patch managers) may execute scripts or binaries that resemble exploit kit behavior.
Filter/Exclusion: Check the process parent or command line for known update tools, or use a filter like process.parent.name == "WindowsUpdate.exe" or process.name == "wusa.exe".
Scenario: Scheduled job for log rotation or data archiving
Description: Automated jobs (e.g., logrotate, data archival scripts) may use similar command-line arguments or file paths as the BlackHole2 Exploit Kit.
Filter/Exclusion: Filter by process.name == "logrotate" or process.name == "archive.bat" and check the job scheduler context (e.g., task scheduler or cron).
Scenario: Admin task for malware analysis or sandboxing
Description: Security teams may run malware samples in a sandboxed environment (e.g., Cuckoo Sandbox, Joe Sandbox) which could trigger the rule.
Filter/Exclusion: Use a filter like process.name == "cuckoo.sh" or process.name == "joe_sandbox.exe" and check for sandbox-specific environment variables.
Scenario: Network scanning or vulnerability assessment tool execution
Description: Tools like Nmap, Nessus, or Qualys may perform network scans that could be misinterpreted as exploit kit activity.
Filter/Exclusion: Filter by process.name == "nmap.exe" or process.name == "nessuscli" and check for scan-related command-line arguments.
Scenario: Internal tool for configuration management or deployment
Description: Internal tools like Ansible, Puppet, or Chef may execute scripts that mimic exploit kit behavior during configuration pushes.
**Filter/