Finds hard coded strings in PolishBankRAT_fdsvc

Hunt Hypothesis

This hunt targets adversary behavior where malicious processes, specifically indicative of PolishBankRAT, expose hardcoded strings that may reveal sensitive configuration details or command-and-control infrastructure. Proactively hunting for these artifacts in Azure Sentinel is critical to identify early-stage infections and potential data leakage before the malware executes its full payload capabilities.

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PolishBankRAT_fdsvc detection rule, including suggested filters and exclusions:

• Scheduled Backup of Legacy Financial Archives

  • Scenario: The enterprise runs a nightly backup job using Veeam Backup & Replication that archives legacy financial reports. These reports contain hardcoded Polish currency symbols (e.g., “zł”, “PLN”) and specific bank routing strings identical to the malware’s signature. When Veeam scans these files, the detection engine flags them as potential RAT artifacts due to the string density.
  • Filter/Exclusion: Create a process exclusion for VeeamAgent.exe and its child processes. Additionally, add a path-based filter to ignore files within the \Finance\Legacy_Archives\ directory during non-business hours (01:00–05:00).

• Deployment of Customer Portal Updates via Octopus Deploy

  • Scenario: The DevOps team utilizes Octopus Deploy to push updates to the customer-facing web portal. The deployment package includes a configuration manifest (appsettings.json) containing hardcoded API endpoints and Polish localization strings (e.g., “Konto Bankowe”, specific IBAN formats) that match the PolishBankRAT_fdsvc pattern. During the extraction phase, these text blocks trigger the rule before the application fully initializes.
  • Filter/Exclusion: Exclude the Octopus Tentacle service (OctopusTentacle.exe) and any processes spawned by it. Implement a logic filter to suppress alerts if the detected strings appear within files with extensions .json, .xml, or .config located in the C:\Deployments\Staging\ directory.

• Automated Compliance Scanning by Splunk Universal Forwarder

  • Scenario: A compliance audit is conducted using **