← Back to SOC feed Coverage →

DNS backdoor used by APT15

yara LOW Yara-Rules
aptbackdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-19T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use a DNS backdoor to exfiltrate data and maintain persistent access, leveraging the APT15 group’s known tactics. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential long-term persistence and data exfiltration activities early.

YARA Rule

rule malware_apt15_royaldll_2	{
	meta:
		author	=	"Ahmed Zaki"
		sha256	=	"bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
		description	=	"DNS backdoor used by APT15"
		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
	strings:
		    $= "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" wide ascii 
		    $= "netsvcs" wide ascii fullword
		    $= "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide ascii fullword
		    $= "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
		    $= "myWObject" wide ascii 
	condition:
		uint16(0) == 0x5A4D and all of them
		and pe.exports("ServiceMain")
		and filesize > 50KB and filesize < 600KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_APT15.yar