Turla Kazuar v3 COM Evasion Techniques
Detects COM-based evasion techniques implemented in the Kazuar v3 loader (hpbprndiLOC.dll). This loader uses sophisticated patchless methods to bypass Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) without modifying memory pages, making detection more difficult. The evasion techniques include COM object manipulation using CoCreateInstance, CLSIDFromString, and IIDFromString to interact with COM objects that can disable ETW and AMSI. Instead of patching EventWrite or EtwEventWrite functions in memory, the loader uses COM interfaces to disable ETW providers without leaving memory modification artifacts. The loader also uses COM objects to disable AmsiScanBuffer functionality without directly patching the function, and implements indirect function calls through control flow redirection to evade static analysis and make reverse engineering more difficult. These techniques are particularly sophisticated because they avoid traditional memory patching methods that are easily detected by security tools. The rule detects processes loading hpbprndiLOC.dll that also show indicators of COM-based ETW/AMSI bypass attempts.
Sigma
