Yara rule to match against memory of processes infected by Urausy skype.dat

Hunt Hypothesis

This hunt targets adversaries leveraging the Urausy malware family to inject malicious code into Skype process memory via a specific skype.dat artifact, indicating an attempt to establish persistence or exfiltrate data through trusted communication channels. Proactively hunting for this signature in Azure Sentinel is critical because low-severity memory anomalies often evade standard alerting thresholds, allowing attackers to maintain stealthy footholds within the organization’s endpoint ecosystem before escalating their activities.

YARA Rule

rule urausy_skype_dat : memory {
	meta:
		author = "AlienVault Labs"
		description = "Yara rule to match against memory of processes infected by Urausy skype.dat"
	strings:
		$a = "skype.dat" ascii wide
		$b = "skype.ini" ascii wide
		$win1 = "CreateWindow"
		$win2 = "YIWEFHIWQ" ascii wide
		$desk1 = "CreateDesktop"
		$desk2 = "MyDesktop" ascii wide
	condition:
		$a and $b and (all of ($win*) or all of ($desk*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Urausy skype.dat detection rule in an enterprise environment, including suggested filters and exclusions:

• Legacy Skype for Business Client Updates

  • Scenario: The Microsoft Update service or a third-party patch management tool (e.g., WSUS, Ivanti, or SCCM) downloads and extracts the skype.dat payload during a scheduled maintenance window to update the legacy Skype for Business client. Since Urausy is historically associated with this specific filename, the Yara rule may flag the memory of the SkypeHost.exe or UpdateService.exe process as infected when it is merely processing a legitimate vendor file.
  • Filter/Exclusion: Create an exclusion based on the Process Name (SkypeHost.exe, Microsoft.Update.Service.exe) combined with the File Hash. Whitelist the known good SHA-256 hash of the official Microsoft-signed skype.dat file found in the %ProgramFiles%\Microsoft Office\root\OfficeXX directory.

• Endpoint Detection and Response (EDR) Scanning Artifacts

  • Scenario: Enterprise EDR agents (such as CrowdStrike Falcon, SentinelOne, or Carbon Black) perform deep memory scans of running applications. When scanning a user’s active Skype session, the agent may inject its own scanning engine into the process memory space. If the skype.dat file is loaded into memory during this scan, the Yara rule might misinterpret the EDR’s scanning activity or the specific memory signature of the legitimate data file as an infection indicator.
  • Filter/Exclusion: Exclude alerts where the Parent Process is a known security agent (e.g., FalconSensor.exe, S1Service.exe) and the User Account belongs to the “Security Admin