detect Lavender(a variant of RedLeaves) in memory

Hunt Hypothesis

This hunt targets the in-memory execution patterns of the Lavender threat actor to identify potential stealthy reconnaissance activities that may evade traditional signature-based detection. Proactively hunting for these specific behavioral indicators within Azure Sentinel is critical to validate early-stage compromises and refine telemetry coverage before the adversary establishes persistence or exfiltrates sensitive data.

YARA Rule

rule Lavender {
          meta:
            description = "detect Lavender(a variant of RedLeaves) in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"
            hash1 = "db7c1534dede15be08e651784d3a5d2ae41963d192b0f8776701b4b72240c38d"

          strings:
            $a1 = { C7 ?? ?? 4C 41 56 45 }
            $a2 = { C7 ?? ?? 4E 44 45 52 }

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detect Lavender (a variant of RedLeaves) rule, tailored for an enterprise environment:

• Scenario: Legitimate Software Deployment via SCCM/MECM

  • Context: During a scheduled patch Tuesday deployment, the System Center Configuration Manager (SCCM) client service (ccmexec.exe) injects code into memory to verify the integrity of installed updates. This injection process mimics the “in-memory” behavior of Lavender, which often hides its presence by modifying existing processes rather than creating new ones.
  • Suggested Filter: Create an exclusion for ccmexec.exe when the parent process is CcmExecService and the memory modification occurs within the standard maintenance window (e.g., 02:00–06:00 UTC). Additionally, whitelist the specific hash of the SCCM update agent if it matches a known benign signature.

• Scenario: Endpoint Protection Heuristic Scans

  • Context: Advanced endpoint protection suites like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently perform deep memory scans where they load heuristic engines directly into the address space of critical system processes (like svchost.exe or explorer.exe). This activity can trigger the “in-memory variant” logic, as the security tool effectively behaves like a resident agent similar to RedLeaves.
  • Suggested Filter: Exclude events where the initiating process is a known EDR agent (e.g., FalconSensorService.exe, MsMpEng.exe) and the action involves “Memory Scan” or “Heuristic Analysis.” Ensure the exclusion applies only when the target process is a standard OS service, not a user-facing application.

• Scenario: Scheduled Backup Agent Operations

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Commvault often