MinkeV101Codius

Hunt Hypothesis

This rule detects the presence of the MinkeV101Codius malware variant, which may indicate an adversary has deployed a low-severity implant or tool for initial access or persistence. Proactively hunting for this signature allows the SOC team to identify compromised hosts early in the kill chain, enabling rapid containment before the malware can escalate privileges or establish lateral movement within the Azure environment.

YARA Rule

rule MinkeV101Codius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs a local build script that invokes codius (a hypothetical internal code analysis or CI/CD wrapper tool) via a scheduled task or cron job to perform static code analysis on a repository.
  • Filter/Exclusion: Exclude processes where the parent process is python.exe, node.exe, or bash.exe and the command line contains arguments like --analyze, --lint, or --build, or exclude paths under standard development directories (e.g., C:\Users\<User>\Projects\, /home/<User>/src/).
• Scenario: An automated backup or archival job uses a utility named codius (or a binary with that name) to compress and encrypt logs before uploading them to an S3 bucket or NAS share.
  • Filter/Exclusion: Exclude executions where the target path ends in .zip, .tar.gz, or .7z, or where the parent process is a known backup tool like VeeamBackup.exe, CommvaultAgent.exe, or rsync.
• Scenario: A security team performs a manual penetration test or red team exercise using a custom tool named MinkeV101Codius or codius to simulate a specific attack vector or collect telemetry.
  • Filter/Exclusion: Exclude processes running from specific test directories (e.g., C:\Temp\RedTeam\, /opt/pentest/tools/) or where the user account belongs to a dedicated “RedTeam” or “SecurityTest” AD group.
• Scenario: A legacy application or plugin (e.g., a PDF editor or media converter) bundles a helper binary named codius for internal processing tasks like color space conversion or metadata stripping.
  • Filter/Exclusion: Exclude executions where the parent process