Odinaff malware

Hunt Hypothesis

This hunt targets the presence of Odinaff malware by identifying its specific execution patterns and file artifacts within the Azure Sentinel environment. Proactively searching for this low-severity threat is essential to detect early-stage infections before they escalate into more complex lateral movement or data exfiltration campaigns.

YARA Rule

rule Odinaff_swift : malware odinaff swift raw{
        meta:
                author = "@j0sm1"
                date = "2016/10/27"
                description = "Odinaff malware"
                reference = "https://www.symantec.com/security_response/writeup.jsp?docid=2016-083006-4847-99"
                filetype = "binary"

        strings:

                $s1 = "getapula.pdb"
                $i1 = "wtsapi32.dll"
                $i2 = "cmpbk32.dll"
                $i3 = "PostMessageA"
                $i4 = "PeekMessageW"
                $i5 = "DispatchMessageW"
                $i6 = "WTSEnumerateSessionsA"

        condition:
                ($s1 or pe.exports("Tyman32")) and (2 of ($i*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• https://www.symantec.com/security_response/writeup.jsp?docid=2016-083006-4847-99
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Odinaff malware detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Management Agent Updates

  • Scenario: The Odinaff engine may flag the background update process of major EDR or patch management tools (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Ivanti) as suspicious activity when they inject code into system processes to verify integrity. This often occurs during off-hours maintenance windows where the agent performs a “self-scan” that mimics malware behavior.
  • Suggested Filter: Exclude events originating from the specific service accounts used by these agents (e.g., svc_crowdstrike, LocalSystem running MsMpEng.exe) and filter out file paths located within known vendor directories such as C:\Program Files\CrowdStrike\ or C:\Windows\System32\Microsoft Defender Antivirus.

• Scheduled Software Deployment Jobs

  • Scenario: Automated deployment tasks using tools like Ansible, SCCM (System Center Configuration Manager), or Chocolatey frequently trigger the rule when they extract compressed archives containing executable payloads to temporary folders (C:\Windows\Temp or C:\ProgramData). The rapid creation of multiple executables and registry modifications during a mass software rollout can resemble an infection spread pattern.
  • Suggested Filter: Create an exclusion for file paths matching the deployment tool’s working directory (e.g., C:\SCCM\Cache, C:\Ansible\deploy) and exclude processes initiated by the specific service accounts running these jobs (e.g., DOMAIN\svc_deployment or NT AUTHORITY\SYSTEM with a parent process of ccmexec.exe).

• Software Development & CI/CD Pipeline Artifacts

  • Scenario: