Plasma

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging specific code patterns identified by the “Plasma” YARA signature to establish persistence or execute initial reconnaissance within the Azure environment. The SOC team should proactively hunt for these indicators in Azure Sentinel to validate the rule’s efficacy and identify potential low-severity threats before they escalate into more complex incidents.

YARA Rule

rule Plasma : RAT
{
    meta:
        author = " Kevin Breen <kevin@techanarchy.net>"
        date = "2014/04"
        ref = "http://malwareconfig.com/stats/Plasma"
        maltype = "Remote Access Trojan"
        filetype = "exe"

    strings:
        $a = "Miner: Failed to Inject." wide
        $b = "Started GPU Mining on:" wide
        $c = "BK: Hard Bot Killer Ran Successfully!" wide
        $d = "Uploaded Keylogs Successfully!" wide
        $e = "No Slowloris Attack is Running!" wide
        $f = "An ARME Attack is Already Running on" wide
        $g = "Proactive Bot Killer Enabled!" wide
        $h = "PlasmaRAT" wide ascii
        $i = "AntiEverything" wide ascii

    condition:
        all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Plasma detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Microsoft Office Click-to-Run Self-Updates

  • Context: The OfficeClickToRun.exe process frequently spawns temporary processes (often named msiexec.exe or specific update agents) that download and execute the “Plasma” payload component to patch Office suites across the fleet. This activity occurs daily during business hours on user workstations.
  • Suggested Filter: Exclude events where the parent process is OfficeClickToRun.exe (Microsoft Corporation) AND the file path contains \Microsoft Office\root\Office16\.

• Scenario: CrowdStrike Falcon Sensor Scheduled Scans

  • Context: During scheduled nightly scans, the CrowdStrike Falcon sensor (csfalcon.exe) injects and executes the Plasma detection module to perform heuristic analysis on running memory. This triggers the YARA rule repeatedly across thousands of endpoints simultaneously at 02:00 AM local time.
  • Suggested Filter: Create an exclusion for the process name csfalcon.exe (Vendor: CrowdStrike) combined with a scheduled task source named “CrowdStrike Scheduled Scan” in the Windows Event Log.

• Scenario: SCCM/MECM Application Deployment Packages

  • Context: System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager deploys the Plasma security agent to new builds via the ccmexec.exe service. When a deployment package is pushed, it extracts and executes the Plasma binary as part of the installation routine, often running under the context of the local system account (NT AUTHORITY\SYSTEM).
  • Suggested Filter: Exclude events where the user account is NT AUTHORITY\SYSTEM AND the command line arguments contain keywords like