Gh0st

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Gh0st remote access trojan to establish persistent command-and-control channels within Azure workloads, often evading standard signature-based detection due to its low-severity footprint. Proactively hunting for this behavior in Azure Sentinel is critical to identify early-stage lateral movement and data exfiltration attempts before they escalate into significant security incidents.

YARA Rule

rule Gh0st : RAT
{
    meta:
        description = "Gh0st"
	author = "botherder https://github.com/botherder"

    strings:
        $ = /(G)host/
        $ = /(i)nflate 1\.1\.4 Copyright 1995-2002 Mark Adler/
        $ = /(d)eflate 1\.1\.4 Copyright 1995-2002 Jean-loup Gailly/
        $ = /(%)s\\shell\\open\\command/
        $ = /(G)etClipboardData/
        $ = /(W)riteProcessMemory/
        $ = /(A)djustTokenPrivileges/
        $ = /(W)inSta0\\Default/
        $ = /(#)32770/
        $ = /(#)32771/
        $ = /(#)32772/
        $ = /(#)32774/

    condition:
        all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Gh0st detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Management Patching Cycles

  • Scenario: During nightly maintenance windows, tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Endpoint Manager push security updates. These agents often inject code into running processes to apply patches without restarting the system, mimicking Gh0st’s DLL injection behavior on critical OS services (e.g., svchost.exe or explorer.exe).
  • Filter/Exclusion: Exclude events where the parent process is a known management agent (ccmexec.exe, IvAgent.exe) and the target process is a standard system service. Additionally, filter by time-of-day (e.g., 02:00–05:00 local time) to align with maintenance windows.

• Enterprise Antivirus Real-Time Scanning

  • Scenario: Next-generation antivirus solutions like CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection frequently perform deep memory scans. To analyze suspicious executables, these EDR agents inject their own scanning DLLs into the address space of active user processes (such as chrome.exe or outlook.exe) to monitor behavior in real-time, triggering Gh0st’s injection logic.
  • Filter/Exclusion: Create a whitelist for known EDR service accounts and specific process names associated with the security suite (e.g., C:\Program Files\CrowdStrike\fsa.exe). Ensure the exclusion applies when the injected module path matches the vendor’s installation directory.

• Scheduled Remote Desktop Administration

  • Scenario: System administrators utilize Microsoft PowerShell Remoting or Remote Desktop Services (RDS) to troubleshoot user