RockLoader Malware

Hunt Hypothesis

This detection rule identifies the initial execution of RockLoader malware, which adversaries deploy to establish persistence and prepare for subsequent payload delivery within Azure environments. The SOC team should proactively hunt for this activity because early identification of RockLoader allows analysts to isolate compromised hosts before the malware escalates to more severe threats like credential theft or lateral movement.

YARA Rule

rule RockLoader{
meta:
name = "RockLoader"
description = "RockLoader Malware"
author = "@seanmw"
strings:
$hdr = {4d 5a 90 00}
$op1 = {39 45 f0 0f 8e b0 00 00 00}
$op2 = {32 03 77 73 70 72 69 6e 74 66 41 00 ce 02 53 65}
condition:
$hdr at 0 and all of ($op*) and filesize < 500KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the RockLoader Malware detection rule in an enterprise environment, including suggested filters and exclusions:

• Microsoft Defender Antivirus Real-Time Scan Execution

  • Scenario: The RockLoader signature often triggers on legitimate file integrity checks performed by Microsoft Defender (or similar EDR agents) when scanning large temporary directories or user downloads. Specifically, the MsMpEng.exe process may spawn child processes that mimic the loader behavior of the malware during a scheduled “Quick Scan.”
  • Filter/Exclusion: Exclude the parent process path C:\Program Files\Windows Defender\MsMpEng.exe and its specific command line arguments containing /scan. Additionally, whitelist the hash of the legitimate scan engine executable.

• Sysinternals Process Explorer or ProcMon Administrative Auditing

  • Scenario: Security analysts frequently use Sysinternals tools (e.g., ProcessExplorer.exe, Procmon.exe) to investigate system performance or network connections. When these tools attach to running processes or monitor file system activity in real-time, they generate loader events that closely resemble the RockLoader’s initial injection phase, particularly when analyzing third-party applications.
  • Filter/Exclusion: Create an exclusion rule for any process originating from the C:\Program Files\Sysinternals\ directory. Filter out alerts where the parent process is identified as a Sysinternals tool and the user context belongs to the “Security Admins” group.

• Scheduled Software Deployment via SCCM or Intune

  • Scenario: Enterprise deployment tools like Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune often push application updates during off-hours. The installation agents (ccmexec.exe or IntuneManagementExtension) utilize a modular loading mechanism to stage and execute installers, which can trigger the RockLoader detection logic when unpacking compressed payloads