Rule to hit on the XORed DoublePulsar shellcode

Hunt Hypothesis

This hunt targets adversaries executing the specific XOR-encoded DoublePulsar shellcode, a signature often associated with advanced persistent threats leveraging the MS17-010 vulnerability for initial access and lateral movement. Proactively hunting for this pattern in Azure Sentinel is critical to identify early-stage infections that may bypass standard signature-based detections due to their obfuscated nature.

YARA Rule

rule DoublePulsarXor_Petya
{
 meta:
   description = "Rule to hit on the XORed DoublePulsar shellcode"
   author = "Patrick Jones"
   company = "Booz Allen Hamilton"
   reference1 ="https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html"
   reference2 = "https://www.boozallen.com/content/dam/boozallen_site/sig/pdf/white-paper/rollup-of-booz-allen-petya-research.pdf"
   date = "2017-06-28"
   hash = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
   hash = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1"
 strings:
   $DoublePulsarXor_Petya = { FD 0C 8C 5C B8 C4 24 C5 CC CC CC 0E E8 CC 24 6B CC CC CC 0F 24 CD CC CC CC 27 5C 97 75 BA CD CC CC C3 FE }
 condition:
   $DoublePulsarXor_Petya
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the XORed DoublePulsar Shellcode detection rule, tailored for an enterprise environment:

• Microsoft Endpoint Configuration Manager (MECM/SCCM) Software Updates

  • Scenario: During scheduled maintenance windows, SCCM agents on Windows workstations execute update packages that utilize PowerShell scripts to download and deploy patches. These scripts often employ XOR-based obfuscation techniques within their embedded shellcode to bypass standard signature checks during the installation phase.
  • Filter/Exclusion: Create an exclusion for processes spawned by ccmexec.exe (SCCM Agent) or UpdateOrchestrator.exe, specifically filtering out memory regions where the parent process is running under the “System” account with a known SCCM service signature hash.

• Sysinternals Suite Automated Auditing Scripts

  • Scenario: Security teams frequently deploy scheduled PowerShell jobs using Sysinternals tools (such as ProcMon.exe or custom scripts leveraging PsExec) to audit system configurations. These scripts often inject XOR-encrypted shellcode into memory to perform real-time registry analysis without triggering standard AV heuristics during the scan execution.
  • Filter/Exclusion: Exclude events where the parent process is powershell.exe running under a specific “Security Audit” service account, and the command line arguments contain references to known Sysinternals tool paths (e.g., \Sysinternals\ProcMon.exe).

• Third-Party Backup Agents (e.g., Veeam or Commvault)

  • Scenario: Enterprise backup agents perform routine data integrity checks by injecting shellcode into the memory of file system filters. To ensure high performance and low overhead, these agents often use XOR-obfuscated code blocks similar to DoublePulsar signatures when initializing their backup engines on domain-joined servers.
  • **Filter/Ex