NoodleCryptv20

Hunt Hypothesis

This hunt hypothesis targets adversaries executing NoodleCrypt ransomware variants that actively target and encrypt critical files within the environment. Proactively hunting for this behavior in Azure Sentinel is essential to identify early-stage encryption activities before they escalate into widespread data unavailability and operational disruption.

YARA Rule

rule NoodleCryptv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 }
	$a1 = { EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 [2] 00 00 EB 01 9A E8 [2] 00 00 EB 01 }

condition:
		$a0 at pe.entry_point or $a1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the NoodleCryptv20 detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Encryption by Veeam Agent

  • Context: The Veeam Agent for Windows runs a scheduled job every night at 02:00 to encrypt local backup archives (.vbk and .vlt files) using AES-256. This process involves rapid file creation and modification patterns that mimic the initial encryption phase of NoodleCrypt ransomware, triggering the YARA rule on the VeeamService.exe process.
  • Filter/Exclusion: Add a whitelist entry for the process name VeeamService.exe (or AgentService.exe) running under the SYSTEM or specific service account context. Alternatively, exclude file paths matching C:\ProgramData\Veeam\BackupRepository\*.

• Scenario: Microsoft Defender Antivirus Cloud Protection Scan

  • Context: During peak business hours, Microsoft Defender performs a “Cloud Block” scan on user profile folders (Documents, Desktop). The heuristic engine creates temporary encrypted cache files and modifies file headers to verify integrity. These operations generate the specific byte sequences and entropy spikes that NoodleCryptv20 identifies as ransomware encryption behavior.
  • Filter/Exclusion: Configure an exclusion in the detection logic for processes where the command line contains Microsoft Defender Antivirus Service or process ID matches the known PID of MsMpEng.exe. Additionally, exclude file extensions commonly used by Defender’s temporary cache (e.g., .tmp, .cache).

• Scenario: Scheduled Database Maintenance via SQL Server Agent

  • Context: The nightly maintenance job for Microsoft SQL Server executes a full backup and compression routine. This involves the sqlservr.exe process writing large, compressed binary