LostDoor

Hunt Hypothesis

This detection identifies potential adversary reconnaissance or lateral movement activities characterized by specific file artifacts defined in the LostDoor YARA signature. Proactive hunting for this behavior in Azure Sentinel is essential to uncover stealthy threats that may evade standard alerting thresholds due to their low severity classification, ensuring early identification of compromised endpoints before escalation occurs.

YARA Rule

rule LostDoor : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/LostDoor"
		maltype = "Remote Access Trojan"
		filetype = "exe"
        
    strings:
    	$a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
        $a1 = "*mlt* = %"
        $a2 = "*ip* = %"
        $a3 = "*victimo* = %"
        $a4 = "*name* = %"
        $b5 = "[START]"
        $b6 = "[DATA]"
        $b7 = "We Control Your Digital World" wide ascii
        $b8 = "RC4Initialize" wide ascii
        $b9 = "RC4Decrypt" wide ascii
        
    condition:
    	all of ($a*) or all of ($b*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the LostDoor detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Policy Updates via Group Policy Objects (GPO)

  • Scenario: The central security team pushes a new definition update or configuration change to all endpoints using Microsoft Endpoint Configuration Manager (SCCM) or native Windows GPO. This triggers the LostDoor YARA rule because the deployment agent modifies critical system files and registry keys in real-time, mimicking the behavior of an unauthorized lateral movement tool.
  • Filter/Exclusion: Exclude processes originating from the SCCM client service (ccmexec.exe) or the Windows Group Policy Client (gpupdate.exe) when they access specific paths under C:\Windows\System32\GroupPolicy or C:\Program Files (x86)\Microsoft Intune Management Extension.

• Scheduled Antivirus Full Scans

  • Scenario: During off-hours (e.g., 02:00 AM), the enterprise antivirus solution, such as CrowdStrike Falcon or SentinelOne, initiates a scheduled full system scan. The scanner engine opens and reads thousands of files across the OS root and application directories to check for signatures, generating file access events that match the LostDoor logic for suspicious enumeration activities.
  • Filter/Exclusion: Create an exclusion rule based on the known antivirus process names (e.g., csagent.exe, SentinelOneAgent.exe) and restrict alerts to non-business hours (01:00–05:00) if the scan is strictly scheduled for that window.

• Patch Management Deployment with Reboot

  • Scenario: An automated patch management tool like Ivanti or ManageEngine performs a critical security update deployment. The process involves downloading patches, extracting them to temporary directories, and replacing system binaries before