Detects systeminfo module from Trickbot Trojan

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Trickbot Trojan’s systeminfo module to gather critical host reconnaissance data for lateral movement planning. Proactively hunting for this specific artifact in Azure Sentinel is essential because its low-severity classification often causes it to be overlooked by automated alerts, allowing early-stage infections to persist undetected within the environment.

YARA Rule

rule MALW_systeminfo_trickbot_module :
Trojan
{
meta:
author = "Marc Salinas @Bondey_m"
description = "Detects systeminfo module from Trickbot Trojan"
strings:
$str_systeminf_01 = "<program>"
$str_systeminf_02 = "<service>"
$str_systeminf_03 = "</systeminfo>"
$str_systeminf_04 =
"GetSystemInfo.pdb"
$str_systeminf_05 = "</autostart>"
$str_systeminf_06 = "</moduleconfig>"
condition:
all of ($str_systeminf_*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Trickbot SystemInfo Module detection rule, tailored for an enterprise environment:

• Endpoint Protection Health Checks via Microsoft Defender for Endpoint

  • Scenario: The native MsMpEng.exe (Microsoft Antimalware) service periodically executes a system inventory scan to update its local threat intelligence database. This process often loads the SystemInfo.dll module or queries WMI classes that mimic the specific behavioral signature of Trickbot’s reconnaissance phase.
  • Filter/Exclusion: Exclude processes where the parent image path is C:\Program Files\Windows Defender\MsMpEng.exe and the loaded module name contains “SystemInfo” with a file hash matching the known Microsoft-signed version of the DLL.

• Scheduled Asset Discovery via SCCM (Configuration Manager)

  • Scenario: The System Center Configuration Manager client (ccmexec.exe) runs scheduled hardware inventory tasks during business hours or maintenance windows. These jobs utilize PowerShell scripts to gather OS details, installed software, and network configurations, frequently invoking the SystemInfo module to parse registry keys similar to Trickbot’s data exfiltration preparation.
  • Filter/Exclusion: Create an exclusion for processes launched by ccmexec.exe with a command line argument containing /taskname:HardwareInventory or specific scheduled task IDs (e.g., Microsoft\CCM\CcmExec) occurring between 02:00 and 06:00 local time.

• Third-Party Patch Management Scans (Ivanti or ManageEngine)

  • Scenario: Enterprise patch management agents, such as Ivanti Endpoint Manager (IvAgent.exe) or ManageEngine Desktop Central (AdmServer.exe), perform pre-deployment system assessments. These tools execute a “System Info” collection routine to verify OS version and service pack levels before