This detection identifies the presence of the Feokt malware family by matching file signatures against known YARA rules to uncover potential initial access or persistence mechanisms within the environment. A proactive hunt is essential in Azure Sentinel because Feokt often exhibits low-severity indicators that may evade standard alerting thresholds, requiring manual investigation to confirm its behavior and prevent lateral movement before it escalates into a significant incident.
rule Feokt
{
meta:
author="malware-lu"
strings:
$a0 = { 89 25 A8 11 40 00 BF [3] 00 31 C0 B9 [3] 00 29 F9 FC F3 AA [61] E8 }
condition:
$a0 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the Feokt detection rule in an enterprise environment, along with recommended filters or exclusions:
Scenario: Enterprise Endpoint Protection Scanning
C:\Program Files\CrowdStrike\ where the parent process is csfalcon.exe, or exclude msmpeng.exe (Microsoft Defender) when running under the context of a scheduled “Antivirus Update” task.Scenario: Automated Backup and Archiving Jobs
SYSTEM or dedicated backup service accounts (e.g., VeeamBackupService) between 01:00 and 05:00 local time, specifically when the file extension is .vbk, .bck, or .zip.Scenario: Software Deployment via Configuration Management