glassrat

Hunt Hypothesis

This detection targets adversaries deploying GlassRAT malware to establish persistent remote access and execute command-and-control communications within the Azure environment. Proactive hunting for this specific signature is essential because its low severity classification often allows initial infections to bypass automated alerts, enabling attackers to maintain a stealthy foothold before expanding their lateral movement.

YARA Rule

rule glassrat: RAT
{
   meta:
        author = "Brian Wallace @botnet_hunter"
   strings:
    	$a = "PostQuitMessage"
        $b = "pwlfnn10,gzg"
        $c = "update.dll"
        $d = "_winver"
   condition:
    	all of them

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the glassrat detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Detection & Response (EDR) Agent Self-Updates

  • Scenario: The glassrat YARA signature often matches the file hashing or memory scanning behavior of major EDR agents performing routine self-updates. For instance, when CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint updates its sensor binaries, it may load modules that match the glassrat heuristic patterns (specifically looking for specific DLL injection signatures or file structure anomalies).
  • Filter/Exclusion: Exclude processes originating from known EDR vendor paths. Create a filter to ignore alerts where the parent process is falcon.sys, s1service.exe, or MsMpEng.exe and the event type is “File Creation” or “Module Load.”

• Scheduled Software Distribution Tasks (SCCM/Intune)

  • Scenario: Enterprise deployment tools frequently trigger this rule during mass software rollouts. When Microsoft Endpoint Configuration Manager (MECM/SCCM) or Microsoft Intune pushes a new application package (e.g., Adobe Acrobat Reader updates) to thousands of endpoints, the temporary extraction and installation scripts often mimic the file manipulation patterns detected by glassrat.
  • Filter/Exclusion: Implement an exclusion based on the parent process name. Exclude alerts where the parent process is ccmexec.exe (SCCM), IntuneManagementExtension.exe, or msiexec.exe running under a scheduled task context (Task Scheduler).

• IT Administration via Remote Desktop Services

  • Scenario: During business hours, System Administrators performing remote maintenance often trigger the rule. When an admin uses Microsoft Remote Desktop (mstsc.exe) to connect to a