NME 11 Public by redlime additional

Hunt Hypothesis

This YARA rule targets specific memory patterns associated with the NME 11 Public malware variant, enabling the detection of in-memory execution artifacts that may evade traditional file-based scanning. Proactively hunting for these signatures in Azure Sentinel allows the SOC team to identify low-severity, potentially stealthy intrusions early in the kill chain before they escalate to lateral movement or data exfiltration.

YARA Rule

rule NME_11_Public_by_redlime_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy .NET application or internal tool (e.g., a custom inventory management system) uses the System.Reflection namespace to dynamically load assemblies or inspect metadata at runtime, which may match the structural patterns or string constants targeted by the NME_11_Public_by_redlime_additional YARA rule.
  • Filter/Exclusion: Exclude processes where the parent process is a known .NET host (e.g., dotnet.exe, w3wp.exe) and the file path resides in a trusted application directory (e.g., C:\Program Files\InternalTools\).
• Scenario: An enterprise antivirus or endpoint detection solution (e.g., CrowdStrike Falcon, SentinelOne) performs in-memory scanning or creates temporary shadow copies of executable files during a full system scan, causing the YARA rule to match the in-memory representation or the temporary .tmp file on disk.
  • Filter/Exclusion: Exclude files with extensions .tmp, .bak, or .old located in standard temp directories (C:\Windows\Temp, C:\Users\<User>\AppData\Local\Temp) where the parent process is a known EDR agent (e.g., FalconSensor.exe, SentinelOneAgent.exe).
• Scenario: A scheduled maintenance job runs a PowerShell script that uses Add-Type or New-Object to instantiate .NET classes for data processing (e.g., CSV parsing or XML manipulation), potentially triggering the rule if the script embeds specific .NET assembly references or public method signatures that align with the YARA pattern.
  • Filter/Exclusion: Exclude events where the command line contains powershell.exe or pwsh.exe and the script path is in a managed automation folder (e.g., C:\Scripts\DailyMaintenance\), provided the parent process is Task Scheduler