← Back to SOC feed Coverage →

Detects ShimRatReporter

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-14T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging the ShimRatReporter utility to establish persistent footholds or exfiltrate data within Azure environments by mimicking legitimate reporting processes. Proactive hunting is essential because this low-severity activity often evades standard alerting thresholds, requiring manual correlation of process lineage and network connections to uncover stealthy lateral movement or command-and-control communications.

YARA Rule

rule shimratreporter: RAT
{
 meta:
  description = "Detects ShimRatReporter"
  author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
  date = "20/11/2015"
  ref = "https://blog.fox-it.com/2016/06/15/mofang-a-politically-motivated-information-stealing-adversary/"


 strings:
  $IpInfo = "IP-INFO"
  $NetworkInfo = "Network-INFO"
  $OsInfo = "OS-INFO"
  $ProcessInfo = "Process-INFO"
  $BrowserInfo = "Browser-INFO"
  $QueryUserInfo = "QueryUser-INFO"
  $UsersInfo = "Users-INFO"
  $SoftwareInfo = "Software-INFO"
  $AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
  $proxy_str = "(from environment) = %s"

  $netuserfun = "NetUserEnum"
  $networkparams = "GetNetworkParams"

 condition:
  all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 12 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the ShimRatReporter detection rule in an enterprise environment, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/RAT_Shim.yar