← Back to SOC feed Coverage →

Feokt

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-08-24T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the presence of the Feokt malware family by matching file signatures against known YARA rules to uncover potential initial access or persistence mechanisms within the environment. A proactive hunt is essential in Azure Sentinel because Feokt often exhibits low-severity indicators that may evade standard alerting thresholds, requiring manual investigation to confirm its behavior and prevent lateral movement before it escalates into a significant incident.

YARA Rule

rule Feokt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 89 25 A8 11 40 00 BF [3] 00 31 C0 B9 [3] 00 29 F9 FC F3 AA [61] E8 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the Feokt detection rule in an enterprise environment, along with recommended filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar