Alien Spy Remote Access Trojan

Hunt Hypothesis

This detection rule identifies the execution of the Alien Spy Remote Access Trojan, which adversaries deploy to establish persistent remote access and exfiltrate sensitive data from compromised endpoints. Proactively hunting for this behavior in Azure Sentinel is critical because its low severity rating often leads to alert fatigue, allowing stealthy initial footholds to go unnoticed until significant lateral movement or data loss occurs.

YARA Rule

rule crime_win_rat_AlienSpy: binary RAT Frutas Unrecom AlienSpy
{
meta:
	description = "Alien Spy Remote Access Trojan"
	author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
	reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
	reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
	date = "2015-04-04"
	filetype = "Java"
	hash_1 = "075fa0567d3415fbab3514b8aa64cfcb"
	hash_2 = "818afea3040a887f191ee9d0579ac6ed"
	hash_3 = "973de705f2f01e82c00db92eaa27912c"
	hash_4 = "7f838907f9cc8305544bd0ad4cfd278e"
	hash_5 = "071e12454731161d47a12a8c4b3adfea"
	hash_6 = "a7d50760d49faff3656903c1130fd20b"
	hash_7 = "f399afb901fcdf436a1b2a135da3ee39"
	hash_8 = "3698a3630f80a632c0c7c12e929184fb"
	hash_9 = "fdb674cadfa038ff9d931e376f89f1b6"

   strings:
		
        $sa_1 = "META-INF/MANIFEST.MF"
        $sa_2 = "Main.classPK"
        $sa_3 = "plugins/Server.classPK"
        $sa_4 = "IDPK"
		
        $sb_1 = "config.iniPK"
        $sb_2 = "password.iniPK"
        $sb_3 = "plugins/Server.classPK"
        $sb_4 = "LoadStub.classPK"
        $sb_5 = "LoadStubDecrypted.classPK"
        $sb_7 = "LoadPassword.classPK"
        $sb_8 = "DecryptStub.classPK"
        $sb_9 = "ClassLoaders.classPK"
		
        $sc_1 = "config.xml"
        $sc_2 = "options"
        $sc_3 = "plugins"
        $sc_4 = "util"
        $sc_5 = "util/OSHelper"
        $sc_6 = "Start.class"
        $sc_7 = "AlienSpy"
        $sc_8 = "PK"
	
  condition:
    
	uint16(0) == 0x4B50 and filesize < 800KB and ( (all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)) )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 20 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Alien Spy Remote Access Trojan detection rule in an enterprise environment, along with suggested filters or exclusions:

• Legitimate IT Administration via RMM Tools: Managed Service Providers (MSPs) often use tools like SolarWinds N-central, Lansweeper, or ManageEngine Desktop Central to push configuration updates. These agents frequently spawn remote access processes that mimic Alien Spy’s behavior by establishing outbound connections to management servers and injecting DLLs into user sessions.

  • Suggested Filter: Exclude traffic originating from known RMM agent executables (e.g., SolarWindsAgent.exe, LansweeperAgent.exe) connecting to the organization’s specific IP ranges or FQDNs defined in the asset inventory.

• Scheduled Remote Desktop Sessions by Help Desk: During business hours, help desk technicians utilize Microsoft Remote Desktop Services (RDS) or Citrix Workspace to troubleshoot user issues. These sessions often involve remote process execution and file transfers that trigger the “remote access” signature of the rule, particularly when a technician logs in to a workstation running legacy software.

  • Suggested Filter: Create an exclusion for source IPs belonging to the Help Desk VLAN or specific jump-host servers (e.g., 10.x.y.z range) during standard business hours (08:00–18:00), focusing on connections where the destination port is 3389 (RDP) or 443 (Citrix).

• Automated Patch Management Deployments: Enterprise patching solutions like Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager frequently deploy remote access components to verify system health before applying updates. These scheduled jobs often launch background services that open listening ports and establish control channels, which the rule may misidentify as a persistent RAT (Remote Access