detect Nanocore in memory

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing Nanocore components to establish a persistent, fileless presence within Azure workloads by executing directly from memory. Proactive hunting is essential because this low-severity, in-memory activity often evades traditional disk-based scanning, requiring deep telemetry analysis in Azure Sentinel to identify early-stage compromise before lateral expansion occurs.

YARA Rule

rule Nanocore {
          meta:
            description = "detect Nanocore in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"

          strings:
            $v1 = "NanoCore Client"
            $v2 = "PluginCommand"
            $v3 = "CommandType"

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “detect Nanocore in memory” rule within an enterprise environment, including suggested filters or exclusions:

• Scheduled Antivirus Scans via Endpoint Protection

  • Scenario: The organization’s standard endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec) initiates a scheduled full-system scan. During this process, the antivirus engine loads its proprietary “Nanocore” scanning module into memory to analyze file integrity and heuristic patterns across the user’s workstation.
  • Suggested Filter: Create an exclusion based on the parent process name (e.g., MsMpEng.exe, CsFalconService.exe) and restrict the alert to specific scheduled time windows (e.g., 02:00–04:00 UTC) where these scans are known to run.

• Software Deployment via Configuration Management Tools

  • Scenario: An automated patch management or software deployment cycle runs using tools like Ansible, SCCM (System Center Configuration Manager), or Intune. These agents often inject a lightweight “Nanocore” runtime into memory to execute PowerShell scripts or perform configuration drift detection on target servers without launching a full GUI application.
  • Suggested Filter: Exclude alerts where the parent process is identified as ccmexec.exe (SCCM), Ansible-Runner, or IntuneManagementExtension, and filter by the specific user context of the service account running the deployment job (e.g., DOMAIN\DeploySvcAccount).

• Database Maintenance and Index Rebuilding Jobs

  • Scenario: On SQL Server or Oracle database servers, a nightly maintenance window triggers an index rebuild or statistics update. The database engine utilizes an internal “Nanocore” utility in memory to handle high-throughput data compression and real-time query optimization during