Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN

Hunt Hypothesis

This hunt targets adversaries leveraging the “Skeleton Key” technique to establish persistent, stealthy access by patching authentication mechanisms across the environment. Proactively hunting for this behavior in Azure Sentinel is critical because it allows the SOC team to identify and remediate unauthorized credential modifications before attackers can leverage them for lateral movement or data exfiltration.

YARA Rule

rule skeleton_key_patcher
{
	meta:
		description = "Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN"
		author = "Dell SecureWorks Counter Threat Unit"
		reference = "http://goo.gl/aAk3lN"
		date = "2015/01/13"
		score = 70
	strings:
		$target_process = "lsass.exe" wide
		$dll1 = "cryptdll.dll"
		$dll2 = "samsrv.dll"

		$name = "HookDC.dll"

		$patched1 = "CDLocateCSystem"
		$patched2 = "SamIRetrievePrimaryCredentials"
		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://goo.gl/aAk3lN
• Source Rule

False Positive Guidance

Based on the “Skeleton Key” detection logic (which monitors for unauthorized or unexpected modifications to authentication mechanisms, such as adding new user accounts with elevated privileges or modifying existing account attributes), here are 4 specific false positive scenarios in a legitimate enterprise environment:

• Scheduled Identity Governance Batch Updates

  • Scenario: The quarterly “Identity Lifecycle Review” job executed by SailPoint IdentityIQ automatically provisions temporary administrative access for auditors. This process creates new service accounts (e.g., svc_audit_temp) with the Admin role and modifies group memberships in Active Directory, triggering the Skeleton Key alert due to the creation of high-privilege identities outside standard business hours.
  • Suggested Filter/Exclusion: Create an exclusion rule for source IPs belonging to the SailPoint management server subnet AND target accounts matching the naming convention svc_audit_* OR svc_governance_*. Additionally, filter events occurring between 02:00 and 04:00 UTC on the first Monday of every quarter.

• Patch Management Agent Deployment via SCCM/MECM

  • Scenario: During a major Windows Update deployment cycle, the Microsoft Endpoint Configuration Manager (MECM) agent pushes a security patch that requires local administrator rights to install specific drivers. The deployment script (Install_Security_Patch.ps1) temporarily modifies the Local Security Authority settings and adds a local service account with elevated privileges on endpoint machines to facilitate the installation, mimicking a “Skeleton Key” modification event.
  • Suggested Filter/Exclusion: Exclude events where the process name is ccmexec.exe or Install_Security_Patch.ps1 AND the user context is NT AUTHORITY\SYSTEM. Furthermore, filter for specific Event IDs (e.g., 4720 for account creation) originating from known SCCM distribution point IP ranges.