← Back to SOC feed Coverage →

detect Formbook in memory

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-03T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing Formbook to establish persistent, fileless execution channels within Azure workloads by injecting code directly into memory. The SOC team should proactively hunt for this behavior because its in-memory nature often bypasses traditional disk-based endpoint protections, requiring specialized telemetry analysis to identify early-stage lateral movement or command-and-control activities before they escalate.

YARA Rule

rule Formbook {
          meta:
            description = "detect Formbook in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"

          strings:
            $sqlite3step = { 68 34 1c 7b e1 }
            $sqlite3text = { 68 38 2a 90 c5 }
            $sqlite3blob = { 68 53 d8 7f 8c }

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “detect Formbook in memory” rule, including suggested filters or exclusions tailored for an enterprise environment:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MalConfScan.yar