CopyMinderMicrocosmLtd

Hunt Hypothesis

This hypothesis targets the presence of the CopyMinder Microcosm Ltd. YARA signature, which indicates the execution or persistence of a specific commercial monitoring or data loss prevention tool that may be deployed without full user awareness. Proactively hunting for this signature allows the SOC to identify potentially unmanaged or shadow IT software in the environment, ensuring that third-party agents are accounted for and do not introduce unexpected data exfiltration channels or performance overhead.

YARA Rule

rule CopyMinderMicrocosmLtd
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 25 [4] EF 6A 00 E8 [4] E8 [4] CC FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator manually installs or updates the CopyMinder client on a workstation using the standard installer executable (CopyMinderSetup.exe or similar) during a patching cycle or new user onboarding.

  • Filter/Exclusion: Exclude alerts where the process name matches CopyMinderSetup.exe, CopyMinderUninstall.exe, or CopyMinderService.exe and the parent process is explorer.exe or cmd.exe initiated by a user in the Domain Admins or IT Support group.

• Scenario: The CopyMinder background service (CopyMinderService.exe) performs routine file scanning or synchronization tasks in the background, which may involve reading/writing to user profile directories or shared network drives, potentially triggering file access or process creation detections if the rule is broad.

  • Filter/Exclusion: Exclude alerts where the process path is C:\Program Files\CopyMinder\CopyMinderService.exe (or equivalent install path) and the action is ProcessStart or FileWrite targeting known CopyMinder cache directories (e.g., %LOCALAPPDATA%\CopyMinder or %PROGRAMDATA%\CopyMinder).

• Scenario: A scheduled task or Group Policy Object (GPO) deployment pushes the CopyMinder client to multiple endpoints simultaneously via a management agent (e.g., SCCM, Intune, or PDQ Deploy), causing a burst of process creations or file writes that may be flagged as anomalous or lateral movement.

  • Filter/Exclusion: Exclude alerts where the parent process is a known deployment agent such as CCMEXEC.EXE (SCCM), IntuneAgent.exe, or PDQDeploy.exe, and the target process is the CopyMinder installer or service executable.

• Scenario: An endpoint DLP or security tool