NME11Publicbyredlime

Hunt Hypothesis

This YARA rule targets specific memory patterns associated with the NME11 public release by RedLime, indicating the presence of a known malware family or exploit kit component within monitored workloads. Proactively hunting for this signature allows the SOC to identify early-stage infections or dormant payloads in Azure Sentinel environments before they can establish persistence or execute lateral movement.

YARA Rule

rule NME11Publicbyredlime
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF [4] 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 [4] FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses Git for Windows or GitHub Desktop to clone a public repository containing the NME11 library (or a project depending on it) into a local workspace. The YARA rule matches the binary or script artifacts associated with the byredlime namespace or specific public release markers within the cloned files.

  • Filter/Exclusion: Exclude files located in standard developer workspace directories (e.g., C:\Users\<User>\source\, C:\dev\, C:\workspaces\) or exclude processes originating from known version control clients (git.exe, githubdesktop.exe) where the file path contains \.git\ or matches the repository name pattern.

• Scenario: An automated CI/CD pipeline (e.g., Jenkins, Azure DevOps, or GitHub Actions) downloads the NME11 public release package or a dependent library from a public CDN or GitHub Releases API during a build step. The downloaded artifact is temporarily stored on the agent node and triggers the YARA match before being compiled or moved to a build artifact store.

  • Filter/Exclusion: Exclude files in temporary build directories (e.g., C:\temp\, C:\jenkins\workspace\, C:\azure-pipelines\) or exclude files with specific extension patterns (.zip, .tar.gz, .nupkg) that are less than 24 hours old and located in build agent scratch spaces.

• Scenario: A software installer for a third-party application that bundles the NME11 library (common in scientific computing, graphics, or network monitoring tools) extracts the library files to a standard installation directory like C:\Program Files\ or C:\Program Files (x86)\. The YARA rule matches the static binary or configuration file