BlackHole2 Exploit Kit Detection

Hunt Hypothesis

The hypothesis is that the detection identifies potential exploitation attempts by the BlackHole2 Exploit Kit, which is commonly used to deliver malware and establish command and control channels. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage compromise attempts before they lead to full-scale attacks.

YARA Rule

rule blackhole2_htm4 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "BlackHole2 Exploit Kit Detection"
   hash0 = "926429bf5fe1fbd531eb100fc6e53524"
   hash1 = "7b6cdc67077fc3ca75a54dea0833afe3"
   hash2 = "82f108d4e6f997f8fc4cc02aad02629a"
   hash3 = "bd819c3714dffb5d4988d2f19d571918"
   hash4 = "9bc9f925f60bd8a7b632ae3a6147cb9e"
   hash0 = "926429bf5fe1fbd531eb100fc6e53524"
   hash2 = "82f108d4e6f997f8fc4cc02aad02629a"
   hash7 = "386cb76d46b281778c8c54ac001d72dc"
   hash8 = "0d95c666ea5d5c28fca5381bd54304b3"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "words.dat"
   $string1 = "/icons/back.gif"
   $string2 = "data.dat"
   $string3 = "files.php"
   $string4 = "js.php"
   $string5 = "template.php"
   $string6 = "kcaptcha"
   $string7 = "/icons/blank.gif"
   $string8 = "java.dat"
condition:
   8 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

Source Rule

False Positive Guidance

Scenario: Scheduled System Maintenance Job
Description: A legitimate scheduled job runs a script that downloads a file from a known BlackHole2 C2 domain as part of a system update or patching process.
Filter/Exclusion: Check the file hash against a trusted whitelist, or filter by process name (e.g., update.exe, patchmgr.exe) and source IP (e.g., internal patch server IP).
Scenario: Admin Tool for Network Monitoring
Description: An administrator uses a tool like Wireshark or tcpdump to capture network traffic, which may include connections to a BlackHole2 C2 domain during analysis.
Filter/Exclusion: Exclude traffic initiated by known monitoring tools (e.g., tcpdump.exe, wireshark.exe) or filter by process owner (e.g., root, admin).
Scenario: Legitimate Software Update from Trusted Vendor
Description: A company uses Microsoft Update or Patch Management System (e.g., Microsoft Endpoint Manager) to download updates, which may include files with similar hashes to BlackHole2 payloads.
Filter/Exclusion: Filter by file path (e.g., C:\Windows\Temp\ or C:\Program Files\Microsoft\) or check the file signature against a trusted certificate or publisher.
Scenario: Internal Red Team Exercise
Description: During a red team simulation, a test payload is deployed that mimics BlackHole2 behavior, including outbound connections to a controlled C2 server.
Filter/Exclusion: Exclude traffic originating from known red team tools (e.g., Metasploit, Cobalt Strike) or filter by source IP (e.g., internal red team lab IP).
Scenario: Cloud Infrastructure Management Tool
Description: A cloud