Rule to detect Termite Ransomware

Hunt Hypothesis

This hypothesis posits that adversaries are deploying Termite ransomware by executing specific file encryption and process injection behaviors within our Azure environment. Proactive hunting is essential despite the low severity rating to identify early-stage infection patterns before they escalate into widespread data unavailability incidents.

YARA Rule

rule termite_ransomware {

   meta:

      description = "Rule to detect Termite Ransomware"
      author = "Marc Rivero | @seifreed"
      reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
      
   strings:
      
      $s1 = "C:\\Windows\\SysNative\\mswsock.dll" fullword ascii
      $s2 = "C:\\Windows\\SysWOW64\\mswsock.dll" fullword ascii
      $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Termite.exe" fullword ascii
      $s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Payment.exe" fullword ascii
      $s5 = "C:\\Windows\\Termite.exe" fullword ascii
      $s6 = "\\Shell\\Open\\Command\\" fullword ascii
      $s7 = "t314.520@qq.com" fullword ascii
      $s8 = "(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
      
   condition:
   
      ( uint16(0) == 0x5a4d and filesize < 6000KB ) and all of them 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Termite Ransomware detection rule in an enterprise environment, including suggested filters or exclusions:

• Enterprise Backup Agent File Encryption

  • Scenario: The backup agent (e.g., Veeam Backup & Replication or Commvault) performs a scheduled “snapshot” job that involves encrypting large volumes of data on the file server. This activity generates high-frequency file modification and encryption events that mimic the rapid file-locking behavior of Termite Ransomware.
  • Filter/Exclusion: Exclude processes running under the specific service account used by the backup agent (e.g., NT SERVICE\VeeamTransportService) or filter out file paths located within designated backup staging directories (e.g., D:\VeeamBackup\Staging).

• Antivirus Real-Time Scanning and Quarantine

  • Scenario: A scheduled full-system scan by an Endpoint Detection and Response (EDR) tool like CrowdStrike Falcon or Microsoft Defender for Endpoint triggers. During this process, the AV engine may temporarily lock files, rename suspicious items to a quarantine folder, or re-encrypt files upon policy updates, creating a signature similar to ransomware encryption.
  • Filter/Exclusion: Whitelist known antivirus processes (e.g., MsMpEng.exe, csfalcon.exe) and exclude file operations occurring in the vendor’s specific quarantine paths (e.g., C:\ProgramData\Microsoft\Windows Defender\Quarantine).

• Database Maintenance and Index Rebuild Jobs

  • Scenario: A nightly maintenance job for a critical database server (e.g., SQL Server 2019) executes an index rebuild or transaction log truncation. These operations involve massive sequential reads/writes and file locking on .mdf and .ldf files