IndiaJuliett 1

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the IndiaJuliett malware family within the environment to establish persistence and execute initial reconnaissance activities. The SOC team should proactively hunt for this signature in Azure Sentinel because early detection of these low-severity indicators allows for rapid containment before the adversary escalates to data exfiltration or lateral movement phases.

YARA Rule

rule IndiaJuliett_1
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source_writeFile = "a164c0ba0be7c33778c12a6457e9c55a2935564a"


	strings:
		$configFilename = {00 73 63 61 72 64 70 72 76  2E 64 6C 6C 00}
		$suicideScript = ":R\nIF NOT EXIST %s GOTO E\ndel /a %s\nGOTO R\n:E\ndel /a d.bat"
		$commKey = { 10 20 30 40 50 60 70 80 90 11 12 13 1A FF EE 48 }
		/*
		.text:10001850                 push    7530h           ; dwTimeout
		.text:10001855                 lea     eax, [esp+420h+a2]
		.text:10001859                 push    4               ; len
		.text:1000185B                 push    eax             ; a2
		.text:1000185C                 push    esi             ; s
		.text:1000185D                 mov     dword ptr [esp+42Ch+a2], 1000h
		.text:10001865                 call    CommSendWithTimeout
		.text:1000186A                 add     esp, 14h
		.text:1000186D                 cmp     eax, 0FFFFFFFFh
		.text:10001870                 jz      loc_10001915
		.text:10001876                 lea     ecx, [esp+418h+random]
		.text:1000187A                 push    ecx             ; a1
		.text:1000187B                 call    Generate16ByteRandomBuffer
		.text:10001880                 push    0               ; fEncrypt
		.text:10001882                 push    7530h           ; dwTimeout		
		*/
		$handshake = { 68 30 75 00 00 [4] 6A 04 5? 5? C? [3] 00 10 00 00 E8 [7] 83 F8 FF 0F 84 ?? ?? 00 00 8? [3] 5? E8 [4] 6A 00 68 30 75 00 00 }

		/*
			68 00 28 00 00     push    2800h
			56                 push    esi
			E8 38 F7 FF FF     call    sub_401000
			// optionally there is a "add esp, 8" in some variants here
			8D 44 24 28        lea     eax, [esp+270h+NumberOfBytesWritten]
			6A 00              push    0               ; lpOverlapped
			50                 push    eax             ; lpNumberOfBytesWritten
			68 00 28 00 00     push    2800h           ; nNumberOfBytesToWrite
			56                 push    esi             ; lpBuffer
			53                 push    ebx             ; hFile
			FF 15 6C 80 40 00  call    ds:WriteFile
			81 ED 00 28 00 00  sub     ebp, 2800h
			81 C7 00 28 00 00  add     edi, 2800h
			81 C6 00 28 00 00  add     esi, 2800h
		*/
	
		$writeFile = {68 00 28 00 00 5?	E8 [4-7] 8D [3] 6A 00 5? 68 00 28 00 00 5? 5? FF 15 [4] 81 ?? 00 28 00 00 81 ?? 00 28 00 00 81 ?? 00 28 00 00}
				
	condition:
		($configFilename in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size)) or 
			$suicideScript in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size)))
		or
		($handshake in ((pe.sections[pe.section_index(".rsrc")].raw_data_offset)..(pe.sections[pe.section_index(".rsrc")].raw_data_offset + pe.sections[pe.section_index(".rsrc")].raw_data_size)) and 
			$commKey in ((pe.sections[pe.section_index(".rsrc")].raw_data_offset)..(pe.sections[pe.section_index(".rsrc")].raw_data_offset + pe.sections[pe.section_index(".rsrc")].raw_data_size)))
		or
		 $writeFile in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the IndiaJuliett 1 detection rule in an enterprise environment, including suggested filters and exclusions:

• Antivirus Real-Time Scanning of Temporary Files

  • Scenario: The YARA rule triggers on legitimate files being scanned by Microsoft Defender Antivirus or CrowdStrike Falcon. Specifically, when the AV engine creates temporary copies (e.g., .tmp extensions) in C:\Windows\Temp or user-specific temp folders to analyze them before deletion, the file structure matches the IndiaJuliett signature.
  • Filter/Exclusion: Exclude processes running under the context of known security vendors (e.g., MsMpEng.exe, CSFalconService.exe) and filter out any file paths containing \Temp\ or ending in .tmp.

• Scheduled Software Deployment via SCCM

  • Scenario: During a nightly maintenance window, Microsoft Endpoint Configuration Manager (MECM/SCCM) deploys updates to the “IndiaJuliett” application suite. The deployment agent (ccmexec.exe) extracts installation packages that contain the specific bytecode patterns identified by the rule, causing alerts on every workstation during the 2:00 AM – 4:00 AM window.
  • Filter/Exclusion: Create a time-based suppression for alerts originating from ccmexec.exe between 01:00 and 05:00 local time, or specifically exclude file paths under C:\Program Files\Microsoft Configuration Manager\.

• Database Backup Operations by SQL Server Agent

  • Scenario: The SQL Server Agent Service executes a scheduled job to back up the “IndiaJuliett” transactional database. During this process, the service writes large binary backup files (.bak) and intermediate log files that trigger the YARA signature due to