FlyingKitten

Hunt Hypothesis

This detection identifies potential early-stage reconnaissance or benign activity associated with the “FlyingKitten” signature, which may indicate an adversary establishing a foothold through specific file patterns or process behaviors. Proactively hunting for this signal in Azure Sentinel allows the SOC team to validate its context against known good baselines before it escalates into a higher-severity incident, ensuring rapid response if malicious intent is confirmed.

YARA Rule

rule FlyingKitten : rat
{
    meta:
        Author      = "CrowdStrike, Inc"
        Date        = "2014/05/13"
        Description = "Flying Kitten RAT"
        Reference   = "http://blog.crowdstrike.com/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten"

    strings:
        $classpath = "Stealer.Properties.Resources.resources"
        $pdbstr = "\\Stealer\\obj\\x86\\Release\\Stealer.pdb"

    condition:
        all of them and uint16(0) == 0x5A4D and uint32(uint32(0x3c)) == 0x4550 and uint16(uint32(0x3C) + 0x16) & 0x2000 == 0 and ((uint16(uint32(0x3c)+24) == 0x010b and uint32(uint32(0x3c)+232) > 0) or (uint16(uint32(0x3c)+24) == 0x020b and uint32(uint32(0x3c)+248) > 0)) 

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the FlyingKitten detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Patch Deployment via SCCM/MECM: The rule may trigger when System Center Configuration Manager (SCCM) agents on endpoints execute scheduled patch installation tasks. These tasks often involve downloading large update packages and executing temporary scripts that match the behavioral patterns of FlyingKitten, specifically during the “Software Updates” maintenance window.

  • Suggested Filter: Exclude processes originating from C:\Windows\CCM\ or parent process names containing ccmexec.exe, limited to execution times between 02:00 and 05:00 local time.

• Endpoint DLP Scanning by Symantec Endpoint Protection (SEP): Legitimate Data Loss Prevention scans initiated by the SEP client can generate file I/O patterns that mimic the rule’s signature. This occurs when the Symantec Endpoint Protection service (rtvsc.exe) performs deep content inspection on user directories, creating temporary memory mappings similar to those flagged by FlyingKitten.

  • Suggested Filter: Create an exclusion for process paths containing \Program Files\Symantec\Symantec Endpoint Protection\ and specifically target the rtvsc.exe executable hash known in the asset inventory.

• Scheduled PowerShell Inventory Scripts: Administrative teams often run custom PowerShell scripts (e.g., Get-Inventory.ps1) via Task Scheduler to audit software versions and license compliance. These scripts frequently invoke external tools or parse large XML/JSON manifests, which can trigger the YARA rule if they utilize specific string patterns defined in FlyingKitten.

  • Suggested Filter: Whitelist executions where the parent process is svchost.exe (specifically the TaskScheduler service) and the command line arguments contain the keyword `-ExecutionPolicy B