FakeTLS ServerHelloGetSelectedCipher

Hunt Hypothesis

This hypothesis posits that adversaries are manipulating TLS handshakes by selecting non-standard ciphers in ServerHello messages to evade signature-based detection and establish covert communication channels. The SOC team should proactively hunt for this behavior in Azure Sentinel to identify early-stage lateral movement or command-and-control traffic that bypasses standard encryption baselines, even when initial alerts are marked as low severity.

YARA Rule

rule FakeTLS_ServerHelloGetSelectedCipher: sharedcode
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"

	strings:
	/*
		24 10           and     al, 10h
		0C 10           or      al, 10h
		89 07           mov     [edi], eax
		66 8B 44 24 14  mov     ax, [esp+0Ch+wCipherSuiteID]
		66 3D 00 C0     cmp     ax, 0C000h
		73 34           jnb     short loc_4067C1
		66 2D 35 00     sub     ax, 35h
		66 F7 D8        neg     ax
		1B C0           sbb     eax, eax
		24 80           and     al, 80h
		05 00 01 00 00  add     eax, 100h
		8B D8           mov     ebx, eax
		53              push    ebx             ; hostshort
	*/

	$a = {	24 10 	0C 10 	89 ?? 	66 8? [3] 66 3? 00 C0 73 ?? 66 2? 35 00 66 F7 ?? 1B ?? 	2? 80 0? 00 01 00 00 8B ?? 5? }

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the FakeTLS_ServerHelloGetSelectedCipher detection rule in an enterprise environment, along with suggested filters or exclusions:

• Legacy Internal Monitoring Agents

  • Scenario: Older versions of internal monitoring agents (e.g., SolarWinds NPM, Nagios Core, or custom Python scripts using pycurl v1.0) running on management servers may initiate TLS handshakes with outdated cipher suites that do not match the modern “selected” cipher expectations defined in the rule logic. These tools often poll internal services every 5 minutes, triggering the alert repeatedly during peak business hours.
  • Filter/Exclusion: Create an exclusion for source IP ranges belonging to the MGMT-SERVERS subnet and specific destination ports (e.g., TCP 8080, 9100) associated with known monitoring tools. Additionally, tune the rule to ignore connections where the User-Agent string contains “SolarWinds”, “Nagios”, or “Python-urllib”.

• Scheduled Certificate Renewal Tasks

  • Scenario: Automated certificate management jobs (e.g., Certbot, Venafi Control Plane, or Microsoft System Center Configuration Manager) perform nightly health checks and renewal simulations. During these scheduled windows, the tools often force a TLS renegotiation using specific legacy ciphers to verify backward compatibility with downstream load balancers before applying new certificates, mimicking the behavior of a “fake” handshake.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts between 02:00 and 04:00 UTC on weekdays for traffic originating from the AUTOMATION-CONTROLLER host group. Alternatively, exclude destination IPs identified as part of the PKI infrastructure (e.g., DNS suffix .pki.internal).

• **CI/CD