← Back to SOC feed Coverage →

Detects Shamoon 2.0 Disttrack Dropper

yara HIGH Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-29T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt targets adversaries deploying the Shamoon 2.0 Disttrack dropper to establish persistence and execute data destruction campaigns within critical Azure workloads. Proactively hunting for this behavior in Azure Sentinel is essential because early identification of the dropper’s unique file manipulation patterns allows the SOC team to isolate compromised assets before the malware propagates its destructive payload across the environment.

YARA Rule

rule Shamoon_Disttrack_Dropper {
   meta:
      description = "Detects Shamoon 2.0 Disttrack Dropper"
      author = "Florian Roth"
      reference = "https://goo.gl/jKIfGB"
      date = "2016-12-01"
      score = 70
      hash1 = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
      hash2 = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
   strings:
      $a1 = "\\#{9A6DB7D2-FECF-41ff-9A92-6EDA696613DF}#" wide
      $a2 = "\\#{8A6DB7D2-FECF-41ff-9A92-6EDA696613DE}#" wide

      $s1 = "\\amd64\\elrawdsk.pdb" fullword ascii
      $s2 = "RawDiskSample.exe" fullword wide
      $s3 = "RawDisk Driver. Allows write access to files and raw disk sectors for user mode applications in Windows 2000 and later." fullword wide
      $s4 = "elrawdsk.sys" fullword wide
      $s5 = "\\DosDevices\\ElRawDisk" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 90KB and 1 of ($a*) and 1 of ($s*) )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 7 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Shamoon 2.0 Disttrack Dropper detection rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_Shamoon.yar