Sakula v1.1

Hunt Hypothesis

This hypothesis posits that adversaries are executing initial reconnaissance or lateral movement activities characterized by the specific behavioral patterns defined in the Sakula v1.1 rule. Proactively hunting for these indicators within Azure Sentinel is essential to identify subtle, low-severity anomalies before they escalate into significant security incidents.

YARA Rule

rule sakula_v1_1: RAT
{
    meta:
        description = "Sakula v1.1"
        date = "2015-10-13"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
    strings:
        $m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "=%s&type=%d"
        $m4 = "?photoid="
        $m5 = "iexplorer"
                $m6 = "net start \"%s\""
        $v1_1 = "MicroPlayerUpdate.exe"
        $MZ = "MZ"
    condition:
        $MZ at 0 and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Sakula v1.1 detection rule in an enterprise environment, including suggested filters and exclusions:

• Patch Management Deployment via SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) agent on a domain-joined workstation initiates a scheduled update cycle during business hours, generating high-volume process creation events that mimic the rule’s trigger logic.
  • Filter/Exclusion: Create an exclusion for processes originating from C:\Windows\CCM\ where the parent process is ccmexec.exe. Additionally, filter out events occurring strictly between 08:00 and 12:00 UTC on Tuesdays and Thursdays (standard patch windows).

• Automated Backup Jobs via Veeam Agent

  • Scenario: The nightly backup job executed by the Veeam Agent for Windows service triggers a series of file integrity checks and temporary file creation, which Sakula v1.1 flags as anomalous behavior due to the rapid succession of I/O operations.
  • Filter/Exclusion: Exclude events where the process name is VeeamAgent.exe or vbragent.exe. Ensure the exclusion applies specifically when the command line arguments contain keywords like -backup, -snapshot, or -fullscan.

• Microsoft Defender Antivirus Real-Time Scanning

  • Scenario: During a scheduled “Quick Scan” triggered by Windows Task Scheduler, Microsoft Defender scans user directories and executes multiple sub-processes to analyze file hashes, causing the detection rule to fire on legitimate scanning activities.
  • Filter/Exclusion: Filter for events where the process image path matches C:\Program Files\Windows Defender\MsMpEng.exe or MsMpRes.dll. Add a condition to ignore these events if the user context is