Poison Ivy

Hunt Hypothesis

This detection rule identifies the presence of the Poison Ivy malware, which adversaries often deploy to establish persistence and exfiltrate sensitive data through its unique command-and-control mechanisms. Proactively hunting for this behavior in Azure Sentinel is critical because early identification allows SOC teams to isolate compromised endpoints before the malware can leverage its low-severity profile to evade standard alerting thresholds and expand laterally across the network.

YARA Rule

rule poisonivy_1 : rat
{
	meta:
		description = "Poison Ivy"
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2013-02-01"
		filetype = "memory"
		version = "1.0" 
		ref1 = "https://code.google.com/p/volatility/source/browse/trunk/contrib/plugins/malware/poisonivy.py"

	strings:
		$a = { 53 74 75 62 50 61 74 68 ?? 53 4F 46 54 57 41 52 45 5C 43 6C 61 73 73 65 73 5C 68 74 74 70 5C 73 68 65 6C 6C 5C 6F 70 65 6E 5C 63 6F 6D 6D 61 6E 64 [22] 53 6F 66 74 77 61 72 65 5C 4D 69 63 72 6F 73 6F 66 74 5C 41 63 74 69 76 65 20 53 65 74 75 70 5C 49 6E 73 74 61 6C 6C 65 64 20 43 6F 6D 70 6F 6E 65 6E 74 73 5C } 
		
	condition:
		$a
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Poison Ivy detection rule, tailored for an enterprise environment with suggested filters and exclusions:

• Scheduled Endpoint Protection Scans

  • Scenario: The daily or weekly full-system scans performed by CrowdStrike Falcon or Microsoft Defender for Endpoint trigger the “Poison Ivy” logic when scanning large directories containing thousands of files. The rule may misinterpret the rapid, sequential file enumeration and metadata checks as suspicious lateral movement or unauthorized access patterns typical of a supply chain compromise.
  • Filter/Exclusion: Create an exclusion based on the specific process names (C:\Program Files\CrowdStrike\csfalcon.exe or MsMpEng.exe) running under the SYSTEM account during standard maintenance windows (e.g., 02:00–04:00 UTC).

• Identity Management Synchronization Jobs

  • Scenario: The Microsoft Azure AD Connect synchronization service runs a delta sync every 30 minutes. During this process, the agent queries and updates user attributes across on-premises Active Directory and cloud identities. This high-volume attribute modification can mimic the “Poison Ivy” signature of unauthorized identity enumeration or privilege escalation attempts.
  • Filter/Exclusion: Exclude events where the source IP belongs to the dedicated Identity Management subnet (e.g., 10.20.50.x) and the target user is a service account with names like CN=ADSync or svc-azure-connect.

• Enterprise Configuration Management Deployments

  • Scenario: Automated configuration updates pushed by Ansible Tower or Chef Client involve agents connecting to target servers to read registry keys, modify file permissions, and install patches. The “Poison Ivy” rule may flag the simultaneous execution of multiple PowerShell scripts and the creation of temporary