This hunt targets adversaries deploying the Shamoon 2.0 Disttrack dropper to establish persistence and execute data destruction campaigns within critical Azure workloads. Proactively hunting for this behavior in Azure Sentinel is essential because early identification of the dropper’s unique file manipulation patterns allows the SOC team to isolate compromised assets before the malware propagates its destructive payload across the environment.
rule Shamoon_Disttrack_Dropper {
meta:
description = "Detects Shamoon 2.0 Disttrack Dropper"
author = "Florian Roth"
reference = "https://goo.gl/jKIfGB"
date = "2016-12-01"
score = 70
hash1 = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
hash2 = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
strings:
$a1 = "\\#{9A6DB7D2-FECF-41ff-9A92-6EDA696613DF}#" wide
$a2 = "\\#{8A6DB7D2-FECF-41ff-9A92-6EDA696613DE}#" wide
$s1 = "\\amd64\\elrawdsk.pdb" fullword ascii
$s2 = "RawDiskSample.exe" fullword wide
$s3 = "RawDisk Driver. Allows write access to files and raw disk sectors for user mode applications in Windows 2000 and later." fullword wide
$s4 = "elrawdsk.sys" fullword wide
$s5 = "\\DosDevices\\ElRawDisk" fullword wide
condition:
( uint16(0) == 0x5a4d and filesize < 90KB and 1 of ($a*) and 1 of ($s*) )
}
This YARA rule can be deployed in the following contexts:
This rule contains 7 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the Shamoon 2.0 Disttrack Dropper detection rule, including suggested filters and exclusions:
Antivirus Real-Time Scanning of Large Archives
.zip or .tar.gz files containing software installers. The scanning engine extracts the archive in memory, mimicking the “dropper” behavior of extracting and executing nested payloads that Shamoon 2.0 is known for.csfalcon.exe, sssd.exe) and the accessed file path resides within the designated “Software Distribution” or “Temp” directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Updates).Scheduled Software Deployment via SCCM/Intune
ccmexec.exe or intunacache) extracts the installer from a network share to the local temp folder and launches the executable, generating file creation and execution events that match the Disttrack dropper signature.ccmexec.exe, Microsoft.Windows.Search.exe, or IntuneManagementExtension.exe AND the command line arguments contain known deployment identifiers (e.g., /install, /quiet, or specific Application IDs).Patch Management Execution by WSUS or Third-Party Tools