← Back to SOC feed Coverage →

createP2P

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-08T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the creation of Peer-to-Peer (P2P) processes, which adversaries often leverage to establish covert communication channels or exfiltrate data without relying on standard enterprise proxies. Proactively hunting for this behavior in Azure Sentinel is critical because low-severity P2P activity can serve as an early indicator of lateral movement or command-and-control infrastructure that might otherwise evade traditional network-based alerts.

YARA Rule

rule createP2P
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"

	strings:
		$ = "CreatP2P Thread" wide

	condition:
		any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

False Positive Guidance

Here are 4 specific false positive scenarios for the createP2P detection rule in an enterprise environment, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/Operation_Blockbuster/general.yara