DIETv100v100d

Hunt Hypothesis

This YARA rule targets specific binary patterns associated with the DIET malware family, indicating the presence of a low-severity threat often used for initial access or persistence. Proactively hunting for these signatures in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing potential lateral movement or data exfiltration before the adversary escalates their activities.

YARA Rule

rule DIETv100v100d
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF [2] 3B FC 72 ?? B4 4C CD 21 BE [2] B9 [2] FD F3 A5 FC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses Python to execute a lightweight data processing script (e.g., pandas or numpy operations) that involves memory-mapped files or complex string manipulation, which may match the heuristic patterns in the DIETv100v100d rule.
  • Filter/Exclusion: Exclude processes where the parent process is python.exe or python3.exe and the command line contains specific library names like pandas, numpy, or scipy.
• Scenario: An enterprise backup agent (such as Veeam, Commvault, or Rubrik) creates temporary shadow copy files or deduplication chunks that exhibit high entropy or specific binary patterns, triggering the YARA rule during the backup window.
  • Filter/Exclusion: Exclude file paths located under known backup directories (e.g., C:\Program Files\Veeam\Backup\, C:\ProgramData\Commvault\) or exclude processes named VeeamBackup.exe, cvbackup.exe, or rubikagent.exe.
• Scenario: A Java-based application server (like Tomcat or WildFly) running a custom JAR file that includes native libraries or obfuscated bytecode for performance optimization, which may be misidentified as malicious by the DIET rule.
  • Filter/Exclusion: Exclude processes where the executable is java.exe or jre.exe and the working directory or command line references standard Java application servers (e.g., catalina.bat, standalone.sh) or specific JAR names known to be internal.
• Scenario: A CI/CD pipeline (using Jenkins, GitLab CI, or Azure DevOps) executes a build step that compiles C/C