DeltaCharlie

Hunt Hypothesis

This detection identifies adversary behavior characterized by specific file artifacts defined by the DeltaCharlie YARA signature, indicating potential early-stage reconnaissance or benign tool deployment within the environment. Proactively hunting for this pattern in Azure Sentinel allows the SOC team to validate low-severity signals against known baselines before they escalate into more complex incidents involving lateral movement or data exfiltration.

YARA Rule

rule DeltaCharlie
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"

	strings:
		$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94 A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77 48 EE 6F 4B  73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2 AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED 39 3F FA D0 AD 3D D9 C5 3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13 B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}
		           
	condition:
		any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the DeltaCharlie detection rule in an enterprise environment, along with recommended filters and exclusions:

• Scenario: Microsoft Defender Antivirus Scheduled Scans

  • Context: The MsMpEng.exe process initiates a scheduled full system scan during off-hours (e.g., 2:00 AM), triggering the DeltaCharlie signature due to high-volume file enumeration and temporary artifact creation in the %TEMP% directory.
  • Filter/Exclusion: Add an exclusion for the executable path C:\Program Files\Windows Defender\MsMpEng.exe combined with a time-based filter (e.g., exclude alerts between 01:00–05:00 UTC).

• Scenario: SCCM Application Deployment via Task Scheduler

  • Context: The System Center Configuration Manager (SCCM) client (ccmexec.exe) executes a scheduled task to deploy a new line-of-business application. This involves extracting compressed payloads and writing configuration files, which matches the DeltaCharlie behavioral pattern of rapid file system modifications by a service account.
  • Filter/Exclusion: Create an exclusion for the parent process C:\Windows\CCM\CcmExec.exe running under the specific security context of the local SYSTEM or domain SCCM-Deploy-Svc user, specifically targeting actions on the C:\ProgramData\Microsoft\App-V directory.

• Scenario: Enterprise Backup Software (Veeam) Snapshot Creation

  • Context: Veeam Backup & Replication (VeeamAgent.exe) performs a pre-snapshot hook that locks and verifies critical database files before initiating the backup job. This activity generates a burst of file handle operations and metadata updates that mimics the DeltaCharlie detection logic for suspicious process injection or file staging.
  • **Filter/Ex