DarkComet 3

Hunt Hypothesis

This detection targets the specific execution patterns of the DarkComet malware, which often establishes persistence through subtle file system modifications that may evade standard signature-based defenses. Proactively hunting for these behaviors in Azure Sentinel is critical to identify early-stage compromise indicators before they escalate into lateral movement or data exfiltration events within the cloud environment.

YARA Rule

rule DarkComet_3 : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/DarkComet"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		// Versions 2x
		$a1 = "#BOT#URLUpdate"
		$a2 = "Command successfully executed!"
		$a3 = "MUTEXNAME" wide
		$a4 = "NETDATA" wide
		// Versions 3x & 4x & 5x
		$b1 = "FastMM Borland Edition"
		$b2 = "%s, ClassID: %s"
		$b3 = "I wasn't able to open the hosts file"
		$b4 = "#BOT#VisitUrl"
		$b5 = "#KCMDDC"
	condition:
		all of ($a*) or all of ($b*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the DarkComet 3 detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Agent Self-Updates

  • Scenario: The DarkComet 3 YARA rule often detects the file hashing or memory injection patterns characteristic of the malware when legitimate Endpoint Detection and Response (EDR) agents perform scheduled definition updates. Specifically, tools like CrowdStrike Falcon, SentinelOne Singularity, or Microsoft Defender for Endpoint may trigger this during their daily “scan engine” update cycle where they inject code into system processes to verify integrity.
  • Filter/Exclusion: Create an exclusion based on the parent process name and file path. Exclude events where the ParentProcessName is CfsService.exe (CrowdStrike), smc.exe (SentinelOne), or MsMpEng.exe (Defender) AND the FilePath contains \Program Files\Microsoft Security Client\Antimalware\.

• Software Deployment via SCCM/Intune

  • Scenario: During mass software deployments, enterprise configuration management tools execute scripts that modify registry keys and inject DLLs into running user sessions. When Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune pushes a critical patch (e.g., Adobe Acrobat Reader updates or Java Runtime Environment), the installation agent (ccmexec.exe or IntuneManagementExtension) mimics the DarkComet behavior of creating temporary files in %TEMP% and executing them with elevated privileges.
  • Filter/Exclusion: Filter for events where the UserAccount is a service account (e.g., DOMAIN\SCCM-Deploy-Svc) or the CommandLine contains specific deployment identifiers like /install, /silent, or the SCCM package ID ({GUID}).