PoetRat Python

Hunt Hypothesis

This detection identifies adversary activity involving the execution of PoetRat Python scripts, which are often used for initial reconnaissance and data exfiltration within cloud workloads. Proactively hunting for this behavior in Azure Sentinel is essential to uncover early-stage lateral movement or persistence mechanisms that may evade standard alerting due to their low severity classification.

YARA Rule

rule PoetRat_Python
{
    meta:
        Author = "Nishan Maharjan"
        Description = "A yara rule to catch PoetRat python scripts"
        Data = "6th May 2020"
    strings:

        // Any of the strings that stand out in the files, these are for the multiple python files, not just for a single file
        $encrptionFunction = "Affine"
        $commands = /version|ls|cd|sysinfo|download|upload|shot|cp|mv|link|register|hid|compress|jobs|exit|tasklist|taskkill/
        $domain = "dellgenius.hopto.org"
        $grammer_massacre = /BADD|Bad Error Happened|/
        $mayBePresent = /self\.DIE|THE_GUID_KEY/
        $pipe_out = "Abibliophobia23"
        $shot = "shot_{0}_{1}.png"
    condition:
        3 of them        
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PoetRat Python detection rule in an enterprise environment, along with suggested filters and exclusions:

• Scenario: Automated Software Deployment via Ansible

  • Context: The IT Operations team uses Ansible to push configuration updates across Windows servers. During these runs, the ansible service spawns a Python process (python.exe) that executes custom modules involving network socket creation and file system enumeration, which mimics PoetRat’s reconnaissance behavior.
  • Filter/Exclusion: Exclude processes where the parent image name is ansible-runner.exe or ansible-playbook.exe, specifically when the command line contains arguments pointing to the standard Ansible installation path (e.g., C:\Program Files\Ansible\bin\python.exe).

• Scenario: Scheduled Data Backup Script using PowerShell

  • Context: A nightly scheduled task runs a custom backup utility written in Python. This script, named BackupAgent.py, is executed by the Windows Task Scheduler (TaskScheduler service). The script opens multiple file handles and establishes connections to an on-premise SQL database for logging, triggering the rule’s indicators of persistent data exfiltration.
  • Filter/Exclusion: Create a signature-based exclusion for processes launched by svchost.exe (specifically the Schedule service) where the process path matches C:\Scripts\BackupAgent\python.exe. Additionally, whitelist the specific hash of the known good BackupAgent.py script.

• Scenario: Enterprise Endpoint Protection Scanning

  • Context: The organization utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint, which includes a Python-based component for real-time heuristic analysis and threat intelligence updates. This component frequently spawns child python.exe processes to analyze memory dumps, generating network traffic patterns identical to