Table 2 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf

Hunt Hypothesis

This hunt hypothesis targets adversaries attempting to establish persistence or execute lateral movement by leveraging specific file artifacts and network patterns associated with the Dexter and Project Hook campaigns within Azure Sentinel. Proactive hunting is essential despite the low severity rating because these historical attack vectors often indicate early-stage reconnaissance that, if left undetected, could evolve into significant financial data exfiltration incidents.

YARA Rule

rule pos_malwre_dexter_stardust
{
meta:
	author = "@patrickrolsen"
	maltype = "Dexter Malware - StarDust Variant"
	version = "0.1"
	description = "Table 2 arbornetworks.com/asert/wp-content/uploads/2013/12/Dexter-and-Project-Hook-Break-the-Bank.pdf"
	reference = "16b596de4c0e4d2acdfdd6632c80c070, 2afaa709ef5260184cbda8b521b076e1, and e3dd1dc82ddcfaf410372ae7e6b2f658"
	date = "12/30/2013"
strings:
	$s1 = "ceh_3\\.\\ceh_4\\..\\ceh_6"
	$s2 = "Yatoed3fe3rex23030am39497403"
	$s3 = "Poo7lo276670173quai16568unto1828Oleo9eds96006nosysump7hove19"
	$s4 = "CommonFile.exe"
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• 16b596de4c0e4d2acdfdd6632c80c070, 2afaa709ef5260184cbda8b521b076e1, and e3dd1dc82ddcfaf410372ae7e6b2f658
• Source Rule

False Positive Guidance

Based on the rule title provided, which references Arbor Networks ASERT and specifically focuses on the “Dexter” and “Project Hook” case studies regarding DDoS attacks targeting banking infrastructure, the detection logic likely monitors for abnormal traffic patterns indicative of volumetric or protocol-based DDoS attacks (such as sudden spikes in SYN packets, UDP floods, or HTTP request anomalies) that mimic legitimate high-volume business transactions.

Here are 4 specific false positive scenarios where this rule would trigger on legitimate enterprise activity:

• Scheduled End-of-Month Financial Reconciliation Jobs

  • Scenario: At the start of a new month (e.g., 1st at 02:00 AM), the bank’s core banking system initiates massive batch processing jobs using tools like IBM Mainframe JCL scripts or SAP Batch Schedulers. These jobs generate a sudden, predictable surge in internal database connections and external API calls to clearinghouses, mimicking the traffic volume of a volumetric DDoS attack.
  • Filter/Exclusion: Create a time-based exclusion for the specific IP ranges of the batch processing servers (e.g., 10.50.20.0/24) during the window of 01:30 to 04:30 UTC on the first day of every month.

• Automated Security Patching and Vulnerability Scans

  • Scenario: The enterprise security team runs weekly vulnerability scans using Tenable Nessus or Qualys. These scanners aggressively probe all public-facing banking web servers (IIS/Apache) with high-frequency TCP SYN packets and HTTP GET requests to identify open ports and software versions. This scanning activity often triggers the “Project Hook” protocol anomaly logic due to the rapid connection establishment rates.
  • Filter/Exclusion: Exclude traffic originating from the