marap

Hunt Hypothesis

This detection identifies the execution of the MARAP utility, a common artifact used by adversaries to enumerate system resources or establish persistence mechanisms within Windows environments. Proactively hunting for this behavior in Azure Sentinel is critical because its low severity classification often causes it to be overlooked during initial triage, allowing attackers to leverage it as a stealthy foothold before escalating their activities.

YARA Rule

rule marap 
{

    meta:
        author = " J from THL <j@techhelplist.com>"
        date = "2018-08-19"
        reference1 = "https://www.virustotal.com/#/file/61dfc4d535d86359c2f09dbdd8f14c0a2e6367e5bb7377812f323a94d32341ba/detection"
        reference2 = "https://www.virustotal.com/#/file/c0c85f93a4f425a23c2659dce11e3b1c8b9353b566751b32fcb76b3d8b723b94/detection"
        reference3 = "https://threatpost.com/highly-flexible-marap-malware-enters-the-financial-scene/136623/"
        reference4 = "https://www.bleepingcomputer.com/news/security/necurs-botnet-pushing-new-marap-malware/"
        version = 1
        maltype = "Downloader"
        filetype = "memory"

    strings:
        $text01 = "%02X-%02X-%02X-%02X-%02X-%02X" wide
        $text02 = "%s, base=0x%p" wide
        $text03 = "pid=%d" wide
        $text04 = "%s %s" wide
        $text05 = "%d|%d|%s|%s|%s" wide
        $text06 = "%s|1|%d|%d|%d|%d|%d|%s" wide
        $text07 = "%d#%s#%s#%s#%d#%s#%s#%d#%s#%s#%s#%s#%d" wide
        $text08 = "%s|1|%d|%d|%d|%d|%d|%s#%s#%s#%s#%d#%d#%d" wide
        $text09 = "%s|0|%d" wide
        $text10 = "%llx" wide
        $text11 = "%s -a" wide

    condition:
        7 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the marap detection rule in an enterprise environment, including suggested filters and exclusions:

• Antivirus Real-Time Scanning of Legacy Archives

  • Scenario: Enterprise endpoint protection tools like Symantec Endpoint Protection or CrowdStrike Falcon frequently scan large .zip or .tar archives containing legacy application binaries. The marap YARA rule may trigger on the temporary extraction process where legitimate archive headers match the signature of known marap variants, mistaking the scanning engine’s file read operations for an active threat execution.
  • Filter/Exclusion: Exclude processes originating from the AV service executable (e.g., Symantec Antivirus.exe or CsAgent.exe) and filter out events where the parent process is the OS File System Monitor (System or svchost.exe) accessing files in temporary directories (e.g., %TEMP%, C:\Windows\Temp).

• Scheduled Software Deployment via SCCM/Intune

  • Scenario: During nightly maintenance windows, Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune pushes application updates that include installer packages wrapped in the marap format. The deployment agent (ccmexec.exe or IntuneManagementExtension) extracts these packages to a local staging folder before installation, triggering the rule on the extraction of legitimate signed installers rather than malicious activity.
  • Filter/Exclusion: Create an exclusion for file paths under standard software distribution directories (e.g., C:\Windows\CCMCache, C:\ProgramData\Microsoft\IntuneManagementExtension) and whitelist the specific hash or digital signature of the deployment agent’s parent process.

• Database Backup Jobs Using Enterprise Tools

  • Scenario: Automated backup jobs running via Veeam Backup & Replication