NeoLitev20

Hunt Hypothesis

This hypothesis targets the presence of the NeoLite v20 malware family, which is often deployed for initial access or lateral movement in enterprise environments. Proactively hunting for this signature allows the SOC team to identify compromised hosts early, preventing potential escalation of privileges or data exfiltration before the adversary establishes a persistent foothold.

YARA Rule

rule NeoLitev20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [28] 4E 65 6F 4C 69 74 65 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator manually deploys or updates the NeoLite database engine on a SQL server or application host using a standard installer or deployment script.
  • Filter/Exclusion: Exclude processes where the parent process is a known installer (e.g., msiexec.exe, setup.exe, install.exe) or where the command line contains arguments like /i, /install, or --install.
• Scenario: A scheduled maintenance job or automated backup script initializes the NeoLite database for nightly data archiving or integrity checks.
  • Filter/Exclusion: Exclude executions where the parent process is a task scheduler or cron equivalent (e.g., svchost.exe with specific service parameters, schtasks.exe, cron, or ansible-playbook) and the working directory is a known data or backup path (e.g., C:\Backups\, /var/backups/).
• Scenario: A developer or QA engineer runs a local application or test harness that embeds the NeoLite library for unit testing or integration testing in a non-production environment.
  • Filter/Exclusion: Exclude hosts tagged as dev, qa, or staging in the asset inventory, or exclude processes where the executable path resides in a development-specific directory (e.g., C:\Projects\, /home/user/dev/, C:\temp\test_app\).
• Scenario: A legacy line-of-business application that relies on NeoLite for local configuration storage or small-scale data management is launched by a user or service start.
  • Filter/Exclusion: Allowlist specific known application executables (e.g., legacy_app.exe, config_manager.exe) that are documented to use NeoLite, or exclude if the NeoLite DLL is loaded by a process from a trusted application directory (e.g., `C