ransom comodosec mrcr1

Hunt Hypothesis

This hunt targets adversaries executing the specific ComodoSec malware payload identified by the ransom_comodosec_mrcr1 YARA signature to detect early-stage ransomware activity. Proactively hunting for this indicator in Azure Sentinel is critical because its low severity classification may cause it to be overlooked during routine monitoring, allowing attackers to establish persistence before triggering higher-level alerts.

YARA Rule

rule ransom_comodosec_mrcr1 {

        meta:
                author = " J from THL <j@techhelplist.com>"
                date = "2017/01"
                reference = "https://virustotal.com/en/file/75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa/analysis/"
                version = 1
                maltype = "Ransomware"
                filetype = "memory"

        strings:
                $text01 = "WebKitFormBoundary"
                $text02 = "Start NetworkScan"
                $text03 = "Start DriveScan"
                $text04 = "Start CryptFiles"
                $text05 = "cmd /c vssadmin delete shadows /all /quiet"
                $text06 = "isAutorun:"
                $text07 = "isNetworkScan:"
                $text08 = "isUserDataLast:"
                $text09 = "isCryptFileNames:"
                $text10 = "isChangeFileExts:"
                $text11 = "isPowerOffWindows:"
                $text12 = "GatePath:"
                $text13 = "GatePort:"
                $text14 = "DefaultCryptKey:"
                $text15 = "UserAgent:"
                $text16 = "Mozilla_"
                $text17 = "On Error Resume Next"
                $text18 = "Content-Disposition: form-data; name=\"uid\""
                $text19 = "Content-Disposition: form-data; name=\"uname\""
                $text20 = "Content-Disposition: form-data; name=\"cname\""
                $regx21 = /\|[0-9a-z]{2,5}\|\|[0-9a-z]{2,5}\|\|[0-9a-z]{2,5}\|\|[0-9a-z]{2,5}\|/


    condition:
        10 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 21 string patterns in its detection logic.

References

• https://virustotal.com/en/file/75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa/analysis/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ransom_comodosec_mrcr1 YARA rule in an enterprise environment, including suggested filters and exclusions:

• Enterprise Backup Agent Snapshot Operations

  • Scenario: The Veeam Backup & Replication agent or Commvault Command Center performs scheduled disk snapshots. These processes often invoke vssadmin or mount temporary volumes to freeze file systems, triggering the YARA rule’s detection of rapid file metadata changes and volume locking typical of ransomware.
  • Suggested Filter: Create an exclusion based on the process image path and parent process. Exclude events where ImageFileName contains \Veeam\Backup\Agent\ or \Commvault\SimAgent\ AND ParentImageFileName is vssadmin.exe or cmdagent.exe.

• Antivirus Real-Time Scanning with Heuristics

  • Scenario: During peak business hours, CrowdStrike Falcon or Microsoft Defender for Endpoint performs deep heuristic scans on large data repositories. The AV engine may lock files and inject memory modules into running processes to analyze code behavior, mimicking the “file enumeration” and “process injection” signatures defined in ransom_comodosec_mrcr1.
  • Suggested Filter: Exclude traffic where the Hash of the executable matches known good AV binaries (e.g., falcon.sys, MsMpEng.exe) AND the CommandLine contains flags related to scanning (e.g., /scan, /heuristic). Alternatively, whitelist specific Service IDs associated with the antivirus engine.

• Scheduled PowerShell Inventory and Patching Scripts

  • Scenario: A nightly scheduled task running a custom PowerShell script (powershell.exe) utilizing the System.Management.Automation module to inventory software assets or