DarkComet 4

Hunt Hypothesis

This detection targets the specific execution patterns of the DarkComet malware family, identifying potential initial access or command-and-control activities within the Azure environment. Proactively hunting for this signature is critical to validate the efficacy of YARA-based defenses and ensure early identification of low-severity threats before they escalate into broader lateral movements.

YARA Rule

rule DarkComet_4  : RAT
{	meta:
		reference = "https://github.com/bwall/bamfdetect/blob/master/BAMF_Detect/modules/yara/darkcomet.yara"
	strings:
	    $a1 = "#BOT#"
	    $a2 = "WEBCAMSTOP"
	    $a3 = "UnActiveOnlineKeyStrokes"
	    $a4 = "#SendTaskMgr"
	    $a5 = "#RemoteScreenSize"
	    $a6 = "ping 127.0.0.1 -n 4 > NUL &&"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• https://github.com/bwall/bamfdetect/blob/master/BAMF_Detect/modules/yara/darkcomet.yara
• Source Rule

False Positive Guidance

Here are four specific false positive scenarios for the DarkComet 4 detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Management Agent Updates

  • Scenario: The DarkComet_4 YARA signature likely detects specific memory injection or process hollowing behaviors. Enterprise Endpoint Detection and Response (EDR) agents like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Carbon Black frequently perform self-updates where the main agent service (MsMpEng.exe or C-Service.exe) injects code into its own child processes to apply hotfixes without a full restart. This legitimate activity mimics the “living off the land” behavior of DarkComet.
  • Filter/Exclusion: Create an exclusion for parent-child process pairs where the parent is a known EDR service (e.g., Microsoft Antimalware Service or CrowdStrike Falcon Sensor) and the child process name matches the agent’s updater executable. Additionally, exclude events occurring during standard maintenance windows (e.g., 02:00–04:00 UTC).

• Scheduled PowerShell Script Execution via Task Scheduler

  • Scenario: DarkComet often utilizes legitimate system tools for execution. In many organizations, IT operations teams schedule complex administrative tasks using Windows Task Scheduler. A common false positive occurs when a scheduled task triggers powershell.exe to execute a script that dynamically loads .NET assemblies or performs remote registry modifications (e.g., a daily compliance check script named ComplianceCheck.ps1). If the YARA rule flags the specific command-line arguments or memory signatures used by these scripts, it will trigger an alert.
  • Filter/Exclusion: Filter alerts where the process path is located in the standard administrative directory (e.g., C:\ProgramData\CompanyScripts\) and the parent process is