RomeoJuliettMikeTwo

Hunt Hypothesis

This detection targets adversaries executing specific file-based activities identified by the “RomeoJuliettMikeTwo” signature, which may indicate early-stage reconnaissance or lateral movement within the environment. Proactively hunting for this behavior in Azure Sentinel is essential to validate the low-severity alert’s context and uncover potential stealthy threats that might otherwise be overlooked due to their initial benign classification.

YARA Rule

rule RomeoJuliettMikeTwo
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "819722ba1c5b9d0b360c54cbdd3811d0cac1a9230720b3ed4815f78bcacb3653_d1ba9ba2987f59d99ce4bf09393c0521c4d1f2961c5aeed4e0bf86e78303d27c"

	strings:
	/*
		81 7C 24 24 33 27 00 00  cmp     [esp+1Ch+dwBytesToRead], 2733h
		75 7F                    jnz     short loc_10002B74
		8D 54 24 14              lea     edx, [esp+1Ch+var_8]
		52                       push    edx             ; Time
		FF 15 5C 11 02 10        call    ds:time
		8B 44 24 14              mov     eax, [esp+20h+var_C]
		83 C4 04                 add     esp, 4
		8B C8                    mov     ecx, eax
		40                       inc     eax
		83 F9 64                 cmp     ecx, 64h
	*/

	$recvFunc = { 81 [3] 33 27 00 00 75 ?? 8D [3] 5? FF 15 [4] 8B [3] 83 ?? 04 8B ?? 4? 83 ?? 64 }

	/*
		E8 74 31 00 00     call    GetStringByIndex
		8B 7C 24 14        mov     edi, [esp+0Ch+dwFuncIndex]
		8B F0              mov     esi, eax
		57                 push    edi             ; index
		E8 68 31 00 00     call    GetStringByIndex
		83 C4 08           add     esp, 8
		85 F6              test    esi, esi
		74 21              jz      short loc_10001040
		85 C0              test    eax, eax
		74 1D              jz      short loc_10001040
		56                 push    esi             ; lpLibFileName
		FF 15 2C 10 02 10  call    ds:LoadLibraryA
		57                 push    edi             ; index
		8B F0              mov     esi, eax
		E8 4E 31 00 00     call    GetStringByIndex
		83 C4 04           add     esp, 4
		50                 push    eax             ; lpProcName
		56                 push    esi             ; hModule
		FF 15 5C 10 02 10  call    ds:GetProcAddress
	*/

	$apiLoader = { E8 [4] 8B [3] 8B ?? 5? E8 [4] 83 C4 08 85 ?? 74 ?? 85 C0 74 ?? 5? FF 15 [4] 5? 8B ?? E8 [4] 83 C4 04 5? 5? FF 15 }

	/*
		68 B8 0B 00 00           push    0BB8h           ; dwMilliseconds
		FF 15 18 10 02 10        call    ds:Sleep
		6A 01                    push    1               ; dwTimeout
		8D 4C 24 10              lea     ecx, [esp+4C0h+peerEntries]
		68 B0 04 00 00           push    4B0h            ; dwBytesToRead
		51                       push    ecx             ; pvRecvBuffer
		8B CE                    mov     ecx, esi        ; this
		C7 44 24 14 B0 04 00 00  mov     [esp+4C8h+Memory], 4B0h
		E8 25 F4 FF FF           call    CClientConnection__RecvData
		83 F8 FF                 cmp     eax, 0FFFFFFFFh
	*/

	$recvPeers = { 68 B8 0B 00 00 FF 15 [4] 6A 01 [0-4] 68 B0 04 00 00 51 8B ?? [1-4] B0 04 00 00 E8 [4] 83 F8 FF	}		
		
	$logFileName = "KBD_%%s_%%02d%%02d%%02d%%02d%%02d.CAT"
	
	condition:
		$recvFunc in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
		or $apiLoader in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
		or $recvPeers in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
		or $logFileName
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the RomeoJuliettMikeTwo detection rule in an enterprise environment, along with recommended filters or exclusions:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: The System Center Configuration Manager (SCCM) or Microsoft Intune agent pushes a critical security patch to the endpoint. During this process, the deployment engine creates temporary executable files in the C:\Windows\CCMCache directory and executes them with elevated privileges to apply updates, which mimics the behavior of an unauthorized script execution.
  • Filter/Exclusion: Exclude file paths containing \CCMCache\ or \Microsoft Intune Management Extension\. Additionally, filter by process name ccmexec.exe and IntuneManagementExtension.exe when the parent process is svchost.exe (specifically the “AppV Client” or “Windows Update” service).

• Scenario: Scheduled Antivirus Real-Time Scanning

  • Context: The enterprise endpoint protection solution, such as CrowdStrike Falcon or Symantec Endpoint Protection, initiates a scheduled deep scan during off-hours. This involves spawning multiple worker threads that read and hash large numbers of files in the C:\ProgramData directory, triggering the rule’s logic regarding high-volume file access patterns.
  • Filter/Exclusion: Create an exclusion for known antivirus process names (e.g., CsFalconService.exe, Symantec AntiVirus.exe) and their child processes. Furthermore, exclude events occurring during the defined maintenance window (e.g., 02:00–04:00 local time) where these scheduled scans are known to run.

• Scenario: PowerShell Administrative Reporting Scripts

  • Context: A global IT administrator runs a recurring PowerShell script (`Get-ADUserReport.ps