Rule to detect XOR DDos infection

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing XOR-based encryption patterns within network traffic to mask Distributed Denial of Service (DDoS) infection stages before full-scale attacks occur. The SOC team should proactively hunt for these subtle indicators in Azure Sentinel to identify early-stage compromises and strengthen defensive postures against evolving DDoS vectors, even when initial severity signals appear low.

YARA Rule

rule XOR_DDosv1 : DDoS
{
  meta:
    author = "Akamai CSIRT"
    description = "Rule to detect XOR DDos infection"
  strings:
    $st0 = "BB2FA36AAA9541F0"
    $st1 = "md5="
    $st2 = "denyip="
    $st3 = "filename="
    $st4 = "rmfile="
    $st5 = "exec_packet"
    $st6 = "build_iphdr"
  condition:
    all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the XOR DDoS Infection detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Legitimate Backup Encryption Operations

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault frequently perform XOR-based checksumming and block-level deduplication during nightly scheduled jobs. These operations generate high-volume read/write patterns with specific XOR byte sequences that mimic the infection’s signature, particularly when processing large database dumps (e.g., SQL Server or Oracle).
  • Filter/Exclusion: Create an exclusion rule for processes running under the VeeamAgent or CommServe service accounts during defined maintenance windows (e.g., 02:00–06:00 UTC). Additionally, filter out network flows originating from backup storage subnets (e.g., 192.168.50.0/24) destined for the primary backup repository.

• Scenario: Antivirus Real-Time Scanning and Heuristic Analysis

  • Context: Endpoint protection suites such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint utilize heuristic scanning engines that decompress and analyze file headers using XOR algorithms to detect obfuscated malware. When these agents scan large executable files (.exe, .dll) in real-time, they trigger the same XOR pattern logic used by the DDoS detection rule, leading to alerts during peak business hours or after patch deployment.
  • Filter/Exclusion: Exclude processes where ProcessName matches known AV executables (e.g., csfalcon.exe, SentinelOneAgent.exe, MsMpEng.exe) and the UserAccount is a system service account (e.g., NT SERVICE\WinDefend). Implement a