Sakula v1.4

Hunt Hypothesis

This detection rule identifies potential early-stage reconnaissance or benign configuration changes associated with the Sakula v1.4 framework within the Azure environment. Proactively hunting for this behavior allows the SOC team to establish a baseline of normal activity and distinguish legitimate operations from subtle anomalies that could indicate an adversary’s initial foothold.

YARA Rule

rule sakula_v1_4: RAT
{
    meta:
        description = "Sakula v1.4"
        date = "2015-10-13"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
    strings:
        $m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "cmd.exe /c rundll32 \"%s\""

        $v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }

        $MZ = "MZ"
    condition:
        $MZ at 0 and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Sakula v1.4 detection rule in an enterprise environment, along with recommended filters or exclusions:

• Antivirus Definition Updates via Windows Update Service

  • Scenario: The WindowsUpdate service (running under LocalSystem) automatically downloads and installs critical security definition updates for Microsoft Defender Antivirus during business hours. This triggers Sakula v1.4 due to the high-frequency file creation and permission changes in the %ProgramData%\Microsoft\Windows Defender directory, mimicking a lateral movement or malware deployment pattern.
  • Filter/Exclusion: Exclude processes where ProcessName is MsMpEng.exe AND ParentImage contains svchost.exe with the service name wuauserv, specifically targeting file paths under C:\ProgramData\Microsoft\Windows Defender.

• Scheduled Group Policy Object (GPO) Deployment

  • Scenario: A nightly scheduled task (gpupdate /force) executed by the Domain Admin account applies new security policies across the domain. This results in mass registry modifications and script executions on endpoint machines, which Sakula v1.4 flags as potential unauthorized configuration changes or policy enforcement attacks.
  • Filter/Exclusion: Create an exclusion for events originating from User accounts ending in _svc_gpo or Domain Admins group membership where the SourceComputer is a Domain Controller, and the event timestamp falls within the maintenance window (e.g., 02:00–04:00 UTC).

• Enterprise Patch Management via SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) client (ccmexec.exe) initiates a software update deployment, installing patches for Adobe Acrobat and Java. The rule triggers on the extraction of compressed archives and the