UnknownDotNet RAT - Bolonyokte

Hunt Hypothesis

This detection rule identifies the execution of the Bolonyokte Remote Access Trojan within .NET applications, signaling potential adversary reconnaissance or lateral movement activities. Proactively hunting for this specific threat in Azure Sentinel is critical to uncover early-stage infections that may evade standard signature-based defenses and prevent unauthorized data exfiltration before escalation.

YARA Rule

rule Bolonyokte : rat 
{
	meta:
		description = "UnknownDotNet RAT - Bolonyokte"
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2013-02-01"
		filetype = "memory"
		version = "1.0" 

	strings:
		$campaign1 = "Bolonyokte" ascii wide
		$campaign2 = "donadoni" ascii wide
		
		$decoy1 = "nyse.com" ascii wide
		$decoy2 = "NYSEArca_Listing_Fees.pdf" ascii wide
		$decoy3 = "bf13-5d45cb40" ascii wide
		
		$artifact1 = "Backup.zip"  ascii wide
		$artifact2 = "updates.txt" ascii wide
		$artifact3 = "vdirs.dat" ascii wide
		$artifact4 = "default.dat"
		$artifact5 = "index.html"
		$artifact6 = "mime.dat"
		
		$func1 = "FtpUrl"
		$func2 = "ScreenCapture"
		$func3 = "CaptureMouse"
		$func4 = "UploadFile"

		$ebanking1 = "Internet Banking" wide
		$ebanking2 = "(Online Banking)|(Online banking)"
		$ebanking3 = "(e-banking)|(e-Banking)" nocase
		$ebanking4 = "login"
		$ebanking5 = "en ligne" wide
		$ebanking6 = "bancaires" wide
		$ebanking7 = "(eBanking)|(Ebanking)" wide
		$ebanking8 = "Anmeldung" wide
		$ebanking9 = "internet banking" nocase wide
		$ebanking10 = "Banking Online" nocase wide
		$ebanking11 = "Web Banking" wide
		$ebanking12 = "Power"

	condition:
		any of ($campaign*) or 2 of ($decoy*) or 2 of ($artifact*) or all of ($func*) or 3 of ($ebanking*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 27 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the UnknownDotNet RAT - Bolonyokte detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Microsoft Endpoint Configuration Manager (MECM/SCCM) Software Deployment

  • Context: During scheduled maintenance windows, SCCM agents push .NET-based application updates or configuration scripts to endpoints. These processes often spawn temporary dotnet.exe instances that load custom assemblies from the C:\Windows\CCMCache directory, mimicking the network behavior of a remote administration tool.
  • Suggested Filter: Exclude traffic where the parent process is ccmexec.exe or the working directory matches the SCCM cache path (C:\Windows\CCMCache\*). Additionally, whitelist the specific SHA-256 hash of the legitimate deployment payload if it remains static across the fleet.

• Scenario: Automated Backup Jobs via Veeam Agent for Windows

  • Context: Enterprise backup agents frequently utilize .NET frameworks to orchestrate data transfer and encryption tasks during off-hours. The VeeamAgent.exe process often spawns child processes that establish outbound connections to central management servers, which can be misidentified as a RAT establishing a command-and-control (C2) channel.
  • Suggested Filter: Create an exclusion for parent processes named VeeamAgent.exe, VeeamTransportSvc.exe, or any process running under the SYSTEM account within the C:\Program Files\Veeam\Backup and Replication Agent\* path.

• Scenario: Custom Internal Reporting Dashboards (Power BI / Tableau)

  • Context: Business intelligence tools like Microsoft Power BI Desktop or Tableau often run as .NET applications on analyst workstations. When users refresh large datasets, these tools initiate background .NET worker processes that connect to internal SQL servers