NeoLitev200

Hunt Hypothesis

This detection identifies potential malware or suspicious artifacts matching the NeoLitev200 signature within the Azure Sentinel environment by leveraging YARA scanning capabilities. Proactive hunting for this indicator is essential to uncover early-stage threats that may evade standard heuristic controls, allowing the SOC team to investigate and contain low-severity anomalies before they escalate into broader incidents.

YARA Rule

rule NeoLitev200
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 44 24 04 23 05 [4] 50 E8 [4] 83 C4 04 FE 05 [4] 0B C0 74 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NeoLitev200 detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Endpoint Protection Scans

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) frequently spawn child processes to scan specific directories. These scans often involve high-volume file I/O that mimics the behavior patterns targeted by NeoLitev200, particularly when scanning large log repositories or backup folders.
  • Filter/Exclusion: Add a process exclusion rule based on known good EDR service names (e.g., C:\Program Files\CrowdStrike\fs_qr.exe or C:\Windows\System32\mpcmdRun.exe) and exclude file paths under standard backup directories like D:\BackupLogs\*.

• Scenario: Scheduled PowerShell Maintenance Scripts

  • Context: IT Operations teams often deploy scheduled tasks (via Windows Task Scheduler) that execute complex PowerShell scripts to clean up temporary files, rotate logs, or update configuration manifests. These scripts frequently utilize file creation and modification patterns that trigger NeoLitev200 when running during off-hours maintenance windows.
  • Filter/Exclusion: Create a filter excluding events where the parent process is powershell.exe (or pwsh.exe) AND the command line contains specific keywords such as -ExecutionPolicy Bypass, or restrict detection to exclude runs occurring between 02:00 and 04:00 local time on weekdays.

• Scenario: Software Deployment via SCCM/Intune

  • Context: During mass software deployments, tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune install agents that extract compressed payloads to temporary directories (C:\Windows\CCMCache or `C:\ProgramData\Microsoft