Sakula v1.2

Hunt Hypothesis

This detection rule identifies potential early-stage reconnaissance or benign configuration changes associated with the Sakula v1.2 framework within Azure Sentinel. Proactively hunting for this behavior allows the SOC team to establish a baseline of normal activity and distinguish genuine low-severity signals from emerging threats before they escalate into critical incidents.

YARA Rule

rule sakula_v1_2: RAT
{
    meta:
        description = "Sakula v1.2"
        date = "2015-10-13"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
    strings:
        $m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "cmd.exe /c rundll32 \"%s\""
        $v1_1 = "MicroPlayerUpdate.exe"
        $v1_2 = "CCPUpdate"

        $MZ = "MZ"
    condition:
        $MZ at 0 and $m1 and $m2 and $m3 and $v1_2 and not $v1_1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Sakula v1.2 detection rule in an enterprise environment, including suggested filters and exclusions:

• Antivirus Definition Updates via WSUS/SCCM

  • Scenario: The daily scheduled task Microsoft Defender Antivirus or Symantec Endpoint Protection initiates a background update process. This involves the service account (e.g., NT SERVICE\Wuauserv) downloading large definition files and executing the installer with elevated privileges, which Sakula v1.2 may flag as suspicious file creation or privilege escalation.
  • Filter/Exclusion: Exclude processes running under the specific S-1-5-20 (Network Service) or S-1-5-19 (Local Service) security identifiers where the parent process is svchost.exe and the command line contains keywords like /update, mpcmdrun.exe, or ccApp.exe.

• Enterprise Backup Jobs (Veeam/Commvault)

  • Scenario: A nightly backup job triggered by Veeam Backup & Replication or Commvault Agent creates temporary snapshot files and modifies registry keys to lock volumes. The rule might detect the rapid creation of large .vbk or .dat files in shared network paths as anomalous file activity, especially if the backup service runs under a generic domain admin account.
  • Filter/Exclusion: Create an exclusion for file system events where the User is a known Backup Service Account (e.g., DOMAIN\VeeamBackupSvc) and the destination path matches the standard backup repository pattern (e.g., \\FileServer\Backups\*). Additionally, exclude specific process names like VeeamAgent.exe, cvagent.exe, or vssadmin.

• **Group Policy Object (