Sakula v1.3

Hunt Hypothesis

This detection rule identifies potential lateral movement or reconnaissance activities associated with the Sakula v1.3 framework by monitoring specific low-severity telemetry patterns within Azure Sentinel. Proactively hunting for this behavior allows the SOC team to establish a baseline of normal operations and detect subtle deviations that may indicate early-stage adversary presence before they escalate into high-impact incidents.

YARA Rule

rule sakula_v1_3: RAT
{
    meta:
        description = "Sakula v1.3"
        date = "2015-10-13"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
    strings:
        $m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "cmd.exe /c rundll32 \"%s\""

        $v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }

        $MZ = "MZ"
    condition:
        $MZ at 0 and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Sakula v1.3 detection rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Antivirus Definition Updates via WSUS/SCCM

  • Scenario: The daily automated deployment of Windows Defender or CrowdStrike definition updates triggers Sakula v1.3 because the update service modifies critical system binaries (e.g., mpengine.dll) and registry keys under the System account during off-hours.
  • Filter/Exclusion: Exclude events where the User Account is NT AUTHORITY\SYSTEM or DOMAIN\SCCM-ServiceAccount, the Process Name matches known AV update executables (e.g., MpCmdRun.exe, CSPUpdate.exe), and the Source IP belongs to the internal patch management server subnet.

• Enterprise Backup Agent Snapshots

  • Scenario: Nightly backup jobs using tools like Veeam Backup & Replication or Commvault create temporary snapshots of active databases (SQL Server, Oracle). This activity generates high-volume file system changes and permission modifications that mimic the behavior Sakula v1.3 is designed to detect as potential lateral movement or data exfiltration.
  • Filter/Exclusion: Create a rule exception for processes running under specific backup service accounts (e.g., DOMAIN\VeeamBackupSvc, DOMAIN\CommvaultAgent) and restrict the scope to file paths containing standard backup staging directories (e.g., C:\Veeam\Backup\Staging, D:\CVData).

• Software Deployment via Microsoft Endpoint Configuration Manager (MECM)

  • Scenario: The rollout of a mandatory application package (such as Adobe Acrobat or Zoom) to 5,000+ endpoints triggers the rule. The deployment agent (ccmexec.exe) executes