Memory string yara for Yordanyan ActiveAgent

Hunt Hypothesis

This hunt targets adversaries leveraging the Yordanyan ActiveAgent tool to execute memory-resident operations, which may indicate early-stage reconnaissance or persistent command-and-control activity within the environment. Proactively hunting for these specific memory signatures in Azure Sentinel is critical because low-severity detections often lack immediate alerting thresholds, requiring manual correlation to distinguish legitimate agent behavior from stealthy threat actor presence.

YARA Rule

rule yordanyan_activeagent {
	meta:
		description = "Memory string yara for Yordanyan ActiveAgent"
		author = "J from THL <j@techhelplist.com>"
		reference1 = "https://www.virustotal.com/#/file/a2e34bfd5a9789837bc2d580e87ec11b9f29c4a50296ef45b06e3895ff399746/detection"
		reference2 = "ETPRO TROJAN Win32.ActiveAgent CnC Create"
		date = "2018-10-04"
		maltype = "Botnet"
		filetype = "memory"

	strings:
		// the wide strings are 16bit bigendian strings in memory. strings -e b memdump.file
		$s01 = "I'm KeepRunner!" wide
		$s02 = "I'm Updater!" wide
		$s03 = "Starting Download..." wide
		$s04 = "Download Complete!" wide
		$s05 = "Running New Agent and terminating updater!" wide
		$s06 = "Can't Run downloaded file!" wide
		$s07 = "Retrying download and run!" wide
		$s08 = "Can't init Client." wide
		$s09 = "Client initialised -" wide
		$s10 = "Client not found!" wide
		$s11 = "Client signed." wide
		$s12 = "GetClientData" wide
		$s13 = "&counter=" wide
		$s14 = "&agent_file_version=" wide
		$s15 = "&agent_id=" wide
		$s16 = "mac_address=" wide
		$s17 = "Getting Attachments" wide
		$s18 = "public_name" wide
		$s19 = "Yor agent id =" wide
		$s20 = "Yor agent version =" wide
		$s21 = "Last agent version =" wide
		$s22 = "Agent is last version." wide
		$s23 = "Updating Agent" wide
		$s24 = "Terminating RunKeeper" wide
		$s25 = "Terminating RunKeeper: Done" wide
		$s26 = "ActiveAgent" ascii
		$s27 = "public_name" ascii

	condition:
		15 of them

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 27 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Memory string yara for Yordanyan ActiveAgent detection rule, including suggested filters and exclusions:

• Scheduled Patch Deployment via SCCM/MECM

  • Scenario: During nightly maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager deploys the latest security agent updates. The deployment package extracts the ActiveAgent binaries to memory before installation, triggering the Yara rule as it scans the loaded string signatures in the ccmexec.exe process space.
  • Suggested Filter: Exclude alerts where the parent process is ccmexec.exe (SCCM) or TaskScheduler and the command line arguments contain /install, /update, or specific SCCM deployment IDs associated with the Yordanyan package.

• Automated Group Policy Object (GPO) Enforcement

  • Scenario: A domain-wide GPO refresh occurs at user logon, forcing the installation or configuration of the ActiveAgent on endpoints that have recently joined the domain. The gpupdate.exe process loads the agent’s memory modules to apply registry keys and service configurations, causing a match on the Yordanyan string signature within the svchost.exe or lsass.exe context.
  • Suggested Filter: Create an exclusion for events originating from the GPO source where the user account is a system account (e.g., NT AUTHORITY\SYSTEM) and the process tree includes gpupdate.exe as a grandparent of the detection trigger.

• Third-Party Endpoint Detection and Response (EDR) Scanning

  • Scenario: An existing EDR solution, such as CrowdStrike Falcon or SentinelOne, performs an on-demand deep scan of running processes. When these scanners inject memory hooks to analyze the ActiveAgent process