detect RedLeaves in memory

Hunt Hypothesis

This detection rule identifies the presence of the RedLeaves threat actor’s artifacts within system memory, signaling potential post-exploitation activity or lateral movement attempts. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to validate low-severity alerts against known adversary behaviors before they escalate into critical incidents.

YARA Rule

rule RedLeaves {
          meta:
            description = "detect RedLeaves in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory block scan"
            reference = "https://blogs.jpcert.or.jp/en/2017/05/volatility-plugin-for-detecting-redleaves-malware.html"
            hash1 = "5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481"

          strings:
            $v1 = "red_autumnal_leaves_dllmain.dll"
            $b1 = { FF FF 90 00 }

          condition: $v1 and $b1 at 0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://blogs.jpcert.or.jp/en/2017/05/volatility-plugin-for-detecting-redleaves-malware.html
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detect RedLeaves in memory rule, tailored for an enterprise environment:

• Automated Patch Management Scans

  • Scenario: The WSUS (Windows Server Update Services) or SCCM (System Center Configuration Manager) agents perform deep memory integrity checks on endpoints during scheduled maintenance windows. These tools inject temporary monitoring hooks into the svchost.exe and wininit.exe processes to verify patch installation status, which mimics the “RedLeaves” signature of anomalous memory injection.
  • Filter/Exclusion: Create an exclusion for process paths matching C:\Windows\CCM\* (SCCM) or C:\Program Files\WSUS\*, and specifically exclude events where the parent process is ccmexec.exe or Wuauserv.exe.

• Enterprise Endpoint Protection Scans

  • Scenario: During real-time scanning cycles, CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint inject their own kernel-level drivers and user-mode agents into running application memory to scan for malware. This legitimate injection activity often triggers the rule’s logic regarding unexpected memory modifications by third-party security tools.
  • Filter/Exclusion: Exclude alerts where the source process name matches known EDR binaries (e.g., csagent.exe, S1Service.exe, MsMpEng.exe) and the operation is identified as a scheduled “On-Demand Scan” or “Real-Time Protection Update.”

• Scheduled Backup and Data Integrity Jobs

  • Scenario: Enterprise backup solutions like Veeam Agent, Commvault, or Acronis Cyber Protect utilize memory-mapped I/O to verify data integrity before archiving. These jobs frequently attach to database processes (e.g., `sqlservr.exe