LimaBravo

Hunt Hypothesis

This detection identifies the execution of specific malicious code patterns defined by the LimaBravo YARA signature, which may indicate early-stage adversary activity or benign anomalies within the environment. Proactive hunting for this rule in Azure Sentinel is recommended to validate its relevance against current threat landscapes and refine alert tuning before escalating low-severity findings into confirmed incidents.

YARA Rule

rule LimaBravo
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "Mwsagent.dll"

	strings:
	/*
		83 C4 34        add     esp, 34h
		83 FD 0A        cmp     ebp, 0Ah
		5D              pop     ebp
		5B              pop     ebx
		7E 12           jle     short loc_1000106F
		57              push    edi             ; Src
		C6 07 4D        mov     byte ptr [edi], 4Dh
		C6 47 01 5A     mov     byte ptr [edi+1], 5Ah
		E8 97 01 00 00  call    ManualImageLoad
	*/

	$a = {83 ?? 34 83 ?? 0A [0-2] 7E ?? 5? C6 ?? 4D C6 [2] 5A E8}

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the LimaBravo detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Agent Self-Updates

  • Scenario: The CrowdStrike Falcon or Microsoft Defender for Endpoint agents perform scheduled self-updates. These processes often spawn child processes that inject code into the kernel or modify system binaries to patch vulnerabilities, which mimics the behavior LimaBravo flags as suspicious.
  • Filter/Exclusion: Create an exclusion based on the parent process path C:\Program Files\CrowdStrike\csagent.exe (or equivalent for Defender) and exclude events where the file hash matches the known signature of the official vendor update package.

• Software Deployment via SCCM or Intune

  • Scenario: System Center Configuration Manager (SCCM) or Microsoft Intune pushes a mandatory application deployment (e.g., Adobe Acrobat Reader or Zoom) to workstations. The installation service (ccmexec.exe or IntuneManagementExtension) executes scripts that modify registry keys and write files to protected directories, triggering the rule’s logic regarding unauthorized system changes.
  • Filter/Exclusion: Exclude events originating from the user context NT AUTHORITY\SYSTEM where the command line contains specific deployment identifiers (e.g., /install, /silent) or is initiated by the Microsoft-Windows-SoftwareCenter service.

• Scheduled Antivirus Scans and Quarantine Actions

  • Scenario: A scheduled full-system scan runs via Symantec Endpoint Protection or McAfee Enterprise. During the scan, if a benign file (such as a large temporary build artifact) is flagged for review, the antivirus engine may temporarily lock, move, or modify the file in real-time, generating alerts that overlap with LimaBravo’s detection of file manipulation anomalies.
  • **Filter/Ex