Detects ShimRat and the ShimRat loader

Hunt Hypothesis

This hunt targets adversaries utilizing the ShimRat framework to establish persistent footholds through its specialized loader mechanism within Azure environments. Proactive hunting is essential to identify early-stage implantation of this specific toolset before it escalates into a broader compromise, ensuring timely remediation despite the rule’s current low severity classification.

YARA Rule

rule shimrat: RAT
{
 meta:
  description = "Detects ShimRat and the ShimRat loader"
  author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
  date = "20/11/2015"
  ref = "https://blog.fox-it.com/2016/06/15/mofang-a-politically-motivated-information-stealing-adversary/"
  
 strings:
  $dll = ".dll"
  $dat = ".dat"
  $headersig = "QWERTYUIOPLKJHG"
  $datasig = "MNBVCXZLKJHGFDS"
  $datamarker1 = "Data$$00"
  $datamarker2 = "Data$$01%c%sData"
  $cmdlineformat = "ping localhost -n 9 /c %s > nul"
  $demoproject_keyword1 = "Demo"
  $demoproject_keyword2 = "Win32App"
  $comspec = "COMSPEC"
  $shim_func1 = "ShimMain"
  $shim_func2 = "NotifyShims"
  $shim_func3 = "GetHookAPIs"


 condition:
  ($dll and $dat and $headersig and $datasig) or ($datamarker1 and $datamarker2) or ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 13 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ShimRat detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Real-Time Scanning of Compressed Archives

  • Scenario: The endpoint protection agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) scans a large .zip or .7z archive containing software installers. During the extraction process, the AV engine spawns a temporary loader process to inspect the embedded executable headers, which mimics the ShimRat loader behavior.
  • Suggested Filter: Exclude processes where the parent process is the specific Antivirus service (e.g., MsMpEng.exe, FalconSensor.exe) and the file path contains common archive extensions (*.zip, *.7z).

• Scheduled Software Deployment via SCCM/Intune

  • Scenario: A System Center Configuration Manager (SCCM) or Microsoft Intune task runs during off-hours to deploy a patch. The deployment agent invokes a custom script loader to verify the integrity of the payload before execution, triggering the ShimRat detection logic on the temporary staging folder.
  • Suggested Filter: Create an exclusion based on the command line arguments containing specific deployment identifiers (e.g., --deployment-id, --task-sequence) and restrict the scope to known administrative service accounts (e.g., DOMAIN\SCCM-Service-Account).

• CI/CD Pipeline Artifact Validation

  • Scenario: A build server running Jenkins or GitLab CI executes a post-build validation step. The pipeline uses a containerized loader tool to verify the digital signatures of newly compiled binaries before pushing them to the artifact repository, generating ShimRat-like process trees on the build agent.
  • Suggested Filter: Exclude events originating from known build server hostnames or IP ranges and filter