detect PoisonIvy in memory

Hunt Hypothesis

This hunt targets adversaries leveraging the PoisonIvy framework to execute malicious payloads directly within memory, thereby evading traditional disk-based file analysis. Proactively searching for these indicators in Azure Sentinel is critical because early detection of this specific in-memory activity allows SOC teams to identify stealthy command-and-control communications before they escalate into broader lateral movements or data exfiltration events.

YARA Rule

rule PoisonIvy {
           meta:
            description = "detect PoisonIvy in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"

          strings:
            $a1 = { 0E 89 02 44 }
            $b1 = { AD D1 34 41 }
            $c1 = { 66 35 20 83 66 81 F3 B8 ED }

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detect PoisonIvy in memory rule, tailored for an enterprise environment:

• Scheduled Group Policy Updates via PowerShell

  • Scenario: The domain controller or a management server executes a scheduled task (e.g., gpupdate /force or custom scripts) that loads the Microsoft.Powershell.Management module. These scripts often instantiate .NET assemblies in memory to enumerate and modify Active Directory objects, mimicking the dynamic code execution behavior of PoisonIvy’s lateral movement phase.
  • Filter/Exclusion: Exclude processes launched by powershell.exe or pwsh.exe when the parent process is Task Scheduler (svchost.exe) or System, specifically filtering for command lines containing keywords like -Command "Invoke-GPUpdate" or paths under C:\Windows\System32\GroupPolicy.

• Endpoint Detection and Response (EDR) Agent Scans

  • Scenario: Enterprise EDR solutions such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently inject their own scanning modules into the memory space of running processes to perform heuristic analysis. This injection creates in-memory code execution events that closely resemble the “living off the land” technique used by PoisonIvy, particularly when the agent scans a process using PowerShell or .NET frameworks.
  • Filter/Exclusion: Whitelist known EDR service executables (e.g., C:\Program Files\CrowdStrike\fs_hids.exe, C:\ProgramData\Microsoft Defender Antivirus\MsMpEng.exe) as parent processes. Additionally, exclude events where the loaded module path matches the vendor’s installation directory structure.

• Enterprise Backup and Data Archiving Jobs

  • Scenario: Backup software like Veeam Backup & Replication, Commvault,