IndiaHotel

Hunt Hypothesis

This detection targets the specific malware signature of IndiaHotel to identify potential supply chain compromises or targeted attacks against hospitality infrastructure within the Azure environment. Proactive hunting for this indicator is essential to validate its presence across tenant workloads and ensure early containment before it escalates into a broader lateral movement incident.

YARA Rule

rule IndiaHotel
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "8a4fc5007faf85e07710dca705108df9fd6252fe3d57dfade314120d72f6d83f"

	strings:
	/*
		6A 0A              push    0Ah             ; int
		8D 85 C4 E4 FF FF  lea     eax, [ebp+Source]
		68 10 02 00 00     push    210h            ; unsigned int
		50                 push    eax             ; void *
		E8 FA 60 00 00     call    ??_L@YGXPAXIHP6EX0@Z1@Z; `eh vector constructor iterator'(void *,uint,int,void (*)(void *),void (*)(void *))
	*/

	$fileExtractorArraySetup = {6A 0A 8D [5-6] 68 10 02 00 00 50 E8}

	condition:
		$fileExtractorArraySetup in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the IndiaHotel detection rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Backup Operations by Veeam

  • Scenario: The nightly backup job executed by Veeam Backup & Replication on a Windows Server hosts a scheduled task that compresses large database files. This process involves reading and writing high volumes of data to the C:\ProgramData\IndiaHotel directory, triggering file integrity checks or specific YARA pattern matches associated with legitimate hotel management software updates.
  • Filter/Exclusion: Add an exclusion for the Veeam service account (svc_veeam_backup) and exclude paths containing \VeeamBackup\ from the rule’s scope. Additionally, filter out events occurring during the maintenance window (e.g., 02:00 – 04:00 UTC) where the source process is vbragent.exe.

• Group Policy Updates via SCCM

  • Scenario: During a quarterly security patch deployment, Microsoft Endpoint Configuration Manager (SCCM) pushes a new Group Policy Object (GPO) to update the IndiaHotel client configuration. The ccmexec.exe process modifies registry keys and copies configuration files into the application directory, mimicking the behavior of a legitimate software installation or update that the YARA rule is designed to detect as an initial infection vector.
  • Filter/Exclusion: Create a whitelist for the SCCM service account (DOMAIN\SCCM-Admin) and exclude any file creation events where the parent process is ccmexec.exe. Furthermore, filter out alerts where the file hash matches known “clean” versions of the IndiaHotel configuration files stored in the enterprise artifact repository.

• Antivirus Real-Time Scanning by CrowdStrike

  • Scenario: The CrowdStrike Falcon sensor