is bot Rebirth gen3

Hunt Hypothesis

This detection identifies the presence of the Rebirth Gen3 bot family, which adversaries often deploy to establish persistent footholds and conduct reconnaissance within Azure environments. Proactive hunting for this specific signature is essential to uncover early-stage lateral movement or command-and-control activity that may evade standard alerting thresholds due to its low severity classification.

YARA Rule

rule is__bot_Rebirth_gen3 {
	meta:
		author = "unixfreaxjp"
		date = "2018-01-21"
	strings:
        	$bot01 = "MIRAITEST" fullword nocase wide ascii
        	$bot02 = "TELNETTEST" fullword nocase wide ascii
        	$bot03 = "UPDATE" fullword nocase wide ascii
        	$bot04 = "PHONE" fullword nocase wide ascii
        	$bot05 = "RANGE" fullword nocase wide ascii
		$bot06 = "KILLATTK" fullword nocase wide ascii
		$bot07 = "STD" fullword nocase wide ascii
        	$bot08 = "BCM" fullword nocase wide ascii
		$bot09 = "NETIS" fullword nocase wide ascii
		$bot10 = "FASTLOAD" fullword nocase wide ascii
	condition:
        	6 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the is__bot_Rebirth_gen3 detection rule in an enterprise environment, along with recommended filters:

• Software Deployment via SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) agent pushes a major update or patch package to endpoints. During this process, the deployment engine executes is__bot_Rebirth_gen3 as part of the installation routine for third-party security agents or legacy application suites managed by IT Operations. This often occurs during scheduled maintenance windows (e.g., Tuesday 2:00 AM).
  • Filter/Exclusion: Exclude alerts where the parent process is ccmexec.exe or SmsHostExec.exe and the file path contains \Microsoft SCCM\. Additionally, filter by time range to suppress alerts occurring strictly within defined maintenance windows.

• Endpoint Detection & Response (EDR) Self-Update

  • Scenario: The organization’s primary EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) initiates a background self-update cycle. The is__bot_Rebirth_gen3 module is triggered as a signature component to verify the integrity of the new agent version before it replaces the running instance, causing a spike in process creation events that match the YARA rule.
  • Filter/Exclusion: Create an exclusion for processes launched by known EDR service executables (e.g., C:\Program Files\CrowdStrike\csfalcon.exe or C:\Windows\System32\MsMpEng.exe). Filter specifically on file hashes that match the known “clean” baseline of the Rebirth module used in the latest approved agent version.

• Automated Compliance Scanning by Qualys

  • Scenario: The Qualys Cloud Agent runs a scheduled vulnerability assessment scan. As part of the deep