DragonArmorOrient

Hunt Hypothesis

This detection identifies potential malicious activity by leveraging the DragonArmorOrient YARA signature to scan for specific file patterns indicative of targeted threats within the Azure Sentinel environment. Proactive hunting is recommended because this rule operates at a low severity level, requiring manual investigation to distinguish between false positives and early-stage adversary behaviors that may not trigger higher-level alerts automatically.

YARA Rule

rule DragonArmorOrient
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 4C [2] 00 83 C9 FF 33 C0 68 34 [2] 00 F2 AE F7 D1 49 51 68 4C [2] 00 E8 11 0A 00 00 83 C4 0C 68 4C [2] 00 FF 15 00 [2] 00 8B F0 BF 4C [2] 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C [2] 00 8B D1 68 34 [2] 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C [2] 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C [2] 00 E8 C0 09 00 00 8B 1D 04 [2] 00 83 C4 0C 68 5C [2] 00 56 FF D3 A3 D4 [2] 00 BF 5C [2] 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C [2] 00 8B D1 68 34 [2] 00 C1 E9 02 F3 AB 8B CA 83 E1 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the DragonArmorOrient detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via Windows Update Service

  • Context: The WindowsUpdate service or a third-party AV agent (e.g., Microsoft Defender, CrowdStrike) periodically downloads and installs new definition packs. These processes often spawn child processes that write to the system directory (C:\ProgramData\Microsoft\Windows Defender) with specific file signatures matching the DragonArmor rule’s heuristic for “suspicious configuration changes.”
  • Filter/Exclusion: Create a process exclusion for UsocDl.exe and MsMpEng.exe. Configure the rule to ignore events where the parent process is svchost.exe with the service name wuauserv or WudfSvc, specifically when the file path contains \Microsoft\Windows Defender\ or \CrowdStrike\.

• Scenario: Enterprise Backup Agent Execution (Veeam/Acronis)

  • Context: During nightly backup windows, agents like Veeam Transport Service (vss.exe) or Acronis Cyber Protect scan and lock large volumes of data. The rule may trigger when these agents create temporary staging files in the root directory of mounted drives, mimicking the “orientation” behavior of a lateral movement attempt.
  • Filter/Exclusion: Exclude file creation events where the process name is vss.exe, AcronisBackupService.exe, or BakAgent.exe. Additionally, filter out alerts occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) for processes running under the SYSTEM account context.

• Scenario: Group Policy Object (GPO) Deployment and Application

  • Context: When