Phoenix Exploit Kit Detection

Hunt Hypothesis

The Phoenix Exploit Kit Detection rule identifies potential exploitation attempts by malicious actors leveraging compromised credentials or misconfigured services to gain unauthorized access. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate early-stage adversary activity that could lead to persistent access or data exfiltration.

YARA Rule

rule phoenix_jar : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Phoenix Exploit Kit Detection"
   hash0 = "a8a18219b02d30f44799415ff19c518e"
   sample_filetype = "unknown"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "r.JM,IM"
   $string1 = "qX$8$a"
   $string2 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProvider5"
   $string3 = "a.classPK"
   $string4 = "6;\\Q]Q"
   $string5 = "h[s] X"
   $string6 = "ToolsDemoSubClass.classPK"
   $string7 = "a.class"
   $string8 = "META-INF/MANIFEST.MFPK"
   $string9 = "ToolsDemoSubClass.classeO"
   $string10 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProviderPK"
condition:
   10 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Scheduled System Backup Using Veeam Backup & Replication
  Filter/Exclusion: process.name != "vbm.exe" or process.name != "VeeamBackup.exe"

• Scenario: Admin Performing PowerShell Script for System Maintenance
  Filter/Exclusion: process.name != "powershell.exe" or process.args not containing "Invoke-Command" and process.args not containing "Start-Process"

• Scenario: Automated Patch Deployment via Microsoft Endpoint Manager (Intune)
  Filter/Exclusion: process.name != "msiexec.exe" or process.args not containing "/i" and process.args not containing "Patch"

• Scenario: Log Management Tool Collecting Logs via Filebeat
  Filter/Exclusion: process.name != "filebeat" or process.args not containing "--config"

• Scenario: Database Maintenance Task Using SQL Server Agent Job
  Filter/Exclusion: process.name != "sqlservr.exe" or process.args not containing "-s" or "-d" and process.args not containing "SQLAgent" or "Maintenance"