Skeleton Key injected Code http://goo.gl/aAk3lN

Hunt Hypothesis

This hypothesis posits that an adversary is leveraging the Skeleton Key technique to inject code into Azure services, enabling them to bypass standard authentication controls and maintain persistent access across the environment. The SOC team should proactively hunt for this behavior in Azure Sentinel because traditional log-based detections often miss these subtle injection events until after a compromise has occurred, making early identification critical for preventing lateral movement.

YARA Rule

rule skeleton_key_injected_code
{
	meta:
		description = "Skeleton Key injected Code http://goo.gl/aAk3lN"
		author = "Dell SecureWorks Counter Threat Unit"
		reference = "http://goo.gl/aAk3lN"
		date = "2015/01/13"
		score = 70
	strings:
		$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }

		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }

		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }

		$patch_SamIRetrieveMultiplePrimaryCredential  = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }

	condition:
		any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://goo.gl/aAk3lN
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Skeleton Key detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Scheduled Group Policy Updates via Microsoft Endpoint Configuration Manager (MECM/SCCM)

  • Context: The SCCM server regularly pushes configuration updates that modify local security policies on domain-joined endpoints. This process often involves the System account injecting code into the Local Security Authority Subsystem Service (LSASS) to update password hashes or credential policies without a user logging in interactively.
  • Suggested Filter/Exclusion: Create an exclusion for events where the Logon User is NT AUTHORITY\SYSTEM (or the specific SCCM service account, e.g., DOMAIN\SCCM-Service) and the Source IP matches the known management server subnet. Additionally, filter by the Process Name of the initiating script (e.g., ccmexec.exe or gpupdate.exe).

• Scenario: Automated Password Rotation via CyberArk Endpoint Privilege Manager

  • Context: The PAM solution performs nightly password rotations for local administrator accounts. During this task, the CyberArk agent injects code into LSASS to securely update the stored credentials (a “Skeleton Key” style operation) before the scheduled job completes. This is a legitimate, high-frequency administrative action.
  • Suggested Filter/Exclusion: Exclude events where the Parent Process Name is CyberArkAgent.exe or EPMSvc.exe. You can further refine this by filtering for specific Event IDs associated with the rotation job (e.g., Event ID 4688 with a known command line string containing “PasswordRotation”) and restricting the time window to off-hours (e.g., 02:00 – 05:00 local time).