detect Himawari(a variant of RedLeaves) in memory

Hunt Hypothesis

This hunt targets the presence of the Himawari malware (a RedLeaves variant) within system memory to identify early-stage reconnaissance or lateral movement activities often missed by signature-based defenses. Proactively hunting for this behavior in Azure Sentinel is critical because Himawari’s low-severity, fileless nature requires deep memory inspection to prevent silent persistence and potential data exfiltration before it escalates into a high-impact incident.

YARA Rule

rule Himawari {
          meta:
            description = "detect Himawari(a variant of RedLeaves) in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "https://www.jpcert.or.jp/present/2018/JSAC2018_01_nakatsuru.pdf"
            hash1 = "3938436ab73dcd10c495354546265d5498013a6d17d9c4f842507be26ea8fafb"

          strings:
            $h1 = "himawariA"
            $h2 = "himawariB"
            $h3 = "HimawariDemo"

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://www.jpcert.or.jp/present/2018/JSAC2018_01_nakatsuru.pdf
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Himawari (RedLeaves) detection rule, along with suggested filters or exclusions:

• Scheduled Antivirus Full Scans

  • Scenario: Enterprise endpoint protection suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection perform deep memory scans during off-hours. These tools inject their own scanning engines into the address space of running processes, creating memory structures and API hooking patterns that closely mimic the initial injection behaviors of Himawari.
  • Suggested Filter: Exclude alerts where the parent process is a known security agent (e.g., MsMpEng.exe, C-WorkerService.exe, or Symantec Antivirus) and the detection timestamp falls within the defined maintenance window (e.g., 02:00 – 04:00 local time).

• Application Deployment via Microsoft Endpoint Configuration Manager (MECM/SCCM)

  • Scenario: During scheduled software deployments, the Configuration Manager Client (ccmexec.exe) or the Microsoft Edge Update Service often loads installation packages directly into memory to execute silent installers. This process involves loading DLLs and creating temporary memory regions that can trigger the “memory variant” signature of RedLeaves/Himawari before the actual application launch.
  • Suggested Filter: Create an exclusion for processes spawned by ccmexec.exe or MicrosoftEdgeUpdate.exe where the command line arguments contain deployment identifiers (e.g., -install, /quiet, or specific SCCM package IDs).

• Java-Based Enterprise Application Startup

  • Scenario: Large-scale enterprise applications running on the Java Virtual Machine (JVM) (such as SAP NetWeaver, Oracle WebLogic, or custom internal tools) utilize aggressive Just-In-Time