← Back to SOC feed Coverage →

PlugX Identifying Strings

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-13T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging PlugX malware to establish persistent footholds within the network by utilizing unique identifying strings for command and control communication. The SOC team should proactively hunt for these specific strings in Azure Sentinel to detect early-stage infections before they escalate into data exfiltration or lateral movement events, given the low severity of initial indicators often leads to delayed manual discovery.

YARA Rule

rule PlugXStrings : PlugX Family
{
    meta:
        description = "PlugX Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-12"
        
    strings:
        $BootLDR = "boot.ldr" wide ascii
        $Dwork = "d:\\work" nocase
        $Plug25 = "plug2.5"
        $Plug30 = "Plug3.0"
        $Shell6 = "Shell6"
      
    condition:
        $BootLDR or ($Dwork and ($Plug25 or $Plug30 or $Shell6))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

False Positive Guidance

Here are 5 specific false positive scenarios for the PlugX Identifying Strings detection rule in an enterprise environment, along with recommended filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/RAT_PlugX.yar