SierraBravo Two

Hunt Hypothesis

This detection identifies the execution of the SierraBravo_Two malware signature, which adversaries often use to establish initial footholds or deploy secondary payloads within Azure workloads. Proactively hunting for this low-severity indicator allows the SOC team to validate its benign nature and uncover potential lateral movement patterns before they escalate into critical incidents.

YARA Rule

rule SierraBravo_Two
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"

	strings:
		/*
		.text:00403D5A                 mov     word ptr [esi+0Eh], 0C807h
		.text:00403D60                 mov     dword ptr [esi+39h], 800000D4h
		.text:00403D67                 mov     byte ptr [edi], 0Ch							<---- ignored
		.text:00403D6A                 mov     word ptr [esi+25h], 0FFh
		.text:00403D70                 mov     word ptr [esi+27h], 0A4h
		.text:00403D76                 mov     word ptr [esi+29h], 4104h
		.text:00403D7C                 mov     word ptr [esi+2Bh], 32h
		
		or
		
		.text:100036F9                 mov     word ptr [ebx+0Eh], 0C807h
														---- begin ignored -----
		.text:100036FF                 rep movsd
		.text:10003701                 lea     edi, [ebx+60h]
		.text:10003704                 mov     ecx, 9
		.text:10003709                 mov     esi, offset aWindows2000219 ; "windows 2000 2195"
														---- end ignored -----
		.text:1000370E                 mov     dword ptr [ebx+39h], 800000D4h
		.text:10003715                 mov     word ptr [ebx+25h], 0FFh
		.text:1000371B                 mov     word ptr [ebx+27h], 0A4h
		.text:10003721                 mov     word ptr [ebx+29h], 4104h
		.text:10003727                 mov     word ptr [ebx+2Bh], 32h
		*/
		$smbComNegotiationPacketGen = { 66 C7 ?? 0E 07 C8 [0-32] C7 ?? 39 D4 00 00 80 [0-32] 66 C7 ?? 25 FF 00 [0-32] 66 C7 ?? 27 A4 00 [0-32]	66 C7 ?? 29 04 41 [0-32] 66 C7 ?? 2B 32 00}

		$lib = "!emCFgv7Xc8ItaVGN0bMf"
		$api1 = "!ctRHFEX5m9JnZdDfpK"
		$api2 = "!emCFgv7Xc8ItaVGN0bMf"
		$api3 = "!VWBeBxYx1nzrCkBLGQO"		
		$pwd = "iamsorry!@1234567"										

		
	condition:
		$smbComNegotiationPacketGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
		or ($pwd in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
		 		and 
		 		($lib in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
				or $api1 in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
				or $api2 in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
				or $api3 in ((pe.sections[pe.section_index(".data")].raw_data_offset)..(pe.sections[pe.section_index(".data")].raw_data_offset + pe.sections[pe.section_index(".data")].raw_data_size))
		))

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SierraBravo Two detection rule in an enterprise environment, along with suggested filters and exclusions:

• Endpoint Protection Policy Updates via CrowdStrike Falcon Sensor

  • Scenario: The CrowdStrike Falcon sensor performs a scheduled configuration refresh or definition update. This process involves the csfalcon.exe service spawning child processes that load new YARA signatures into memory, which mimics the behavior pattern (e.g., specific DLL injection or script execution) targeted by the SierraBravo Two rule.
  • Filter/Exclusion: Create an exclusion for the parent process path C:\Program Files\CrowdStrike\csfalcon.exe and any child processes spawned with the command line argument containing /update-policy.

• Microsoft SCCM (Endpoint Configuration Manager) Application Deployment

  • Scenario: During a business-hours maintenance window, the SCCM client (ccmexec.exe) executes a PowerShell script to deploy new security patches or software packages. This script often utilizes Invoke-WebRequest and temporary file creation in %TEMP%, triggering the rule’s logic regarding network resource access and file system manipulation by administrative scripts.
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe AND the user account belongs to the SCCM-Service-Accounts security group, specifically filtering for command lines containing InstallApplication or SoftwareUpdate.

• Automated Backup Operations via Veeam Backup & Replication

  • Scenario: The nightly scheduled job runs the Veeam Agent (VBRService.exe) to perform a full image backup. This involves high-volume disk I/O and temporary staging of data blocks, which can be misinterpreted by SierraBravo Two as anomalous data exfiltration or unauthorized process execution due to the sheer volume of file handles opened in