Regla para detectar Tesla con md5

Hunt Hypothesis

This hypothesis posits that adversaries are attempting to establish persistence or execute lateral movement by deploying Tesla-based agents with specific MD5 hashes within the Azure environment. The SOC team should proactively hunt for these artifacts in Azure Sentinel to identify potential low-severity anomalies early, ensuring that legitimate telemetry is distinguished from unauthorized software installations before they escalate into critical incidents.

YARA Rule

rule TeslaCrypt {
meta:
    description = "Regla para detectar Tesla con md5"
    author = "CCN-CERT"
    version = "1.0"
strings:
    $ = { 4E 6F 77 20 69 74 27 73 20 25 49 3A 25 4D 25 70 2E 00 00 00 76 61 6C 20 69 73 20 25 64 0A 00 00 }
condition:
    all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the “Regla para detectar Tesla con md5” rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Integrity Scanning by Security Tools

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents or dedicated file integrity monitoring tools (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Tripwire) perform routine background scans of the C:\Program Files\Tesla directory. These tools calculate MD5 hashes to verify that critical Tesla application binaries have not been tampered with, triggering the detection rule repeatedly during their scheduled maintenance windows (e.g., every Sunday at 02:00 AM).
  • Filter/Exclusion: Create an exclusion based on the Process Name and Parent Process. Exclude events where ProcessName is CrowdStrike.exe, MsMpEng.exe, or TripwireAgent.exe AND ParentImage corresponds to the respective service host (e.g., svchost.exe or the specific agent service).

• Automated Patch Management and Deployment

  • Scenario: IT administrators utilize patch management platforms like Microsoft SCCM (Configuration Manager), Ivanti, or Ansible to deploy updates to the Tesla fleet management software. During these deployments, the deployment engine extracts new binaries and calculates their MD5 checksums before installation to ensure package integrity, mimicking the behavior of a manual hash verification.
  • Filter/Exclusion: Implement a filter on the User Account and Process Path. Exclude events initiated by service accounts such as DOMAIN\SCCM-Deploy-Svc or DOMAIN\Ansible-Automation where the process path contains keywords like \Microsoft SCCM\, \Ivanti\, or \ansible-runner\.

• **Backup and