Crunch5Fusion4

Hunt Hypothesis

This detection identifies potential file-based threats matching the specific signature of the Crunch5Fusion4 YARA rule within Azure Sentinel’s workload protection data. Proactively hunting for this indicator allows the SOC team to uncover early-stage malware or suspicious artifacts that may not trigger high-severity alerts, ensuring comprehensive coverage against low-fidelity but significant security events.

YARA Rule

rule Crunch5Fusion4
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 15 03 [3] 06 [11] 68 [4] 55 E8 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for Rule: Crunch5Fusion4

• Scenario: Microsoft Defender Antivirus Scheduled Full Scan

  • Context: The daily full scan initiated by the Windows Task Scheduler triggers the YARA rule because the scanning engine (MsMpEng.exe) loads multiple dynamic modules and scans large file sets, mimicking the behavior patterns of the target threat.
  • Filter/Exclusion: Create an exclusion for process MsMpEng.exe when the parent process is svchost.exe (specifically the “Windows Defender Antivirus Service” instance) running during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Jenkins CI/CD Pipeline Artifact Compilation

  • Context: During nightly build jobs, the Jenkins agent executes java.exe to compile large codebases and generate artifacts. The rule detects the high-volume file I/O and memory allocation of the Java Virtual Machine as suspicious fusion activity.
  • Filter/Exclusion: Exclude alerts where the process name is java.exe (or javaw.exe) and the command line contains the flag -Djenkins.agent, provided the execution occurs on designated build servers (e.g., hostnames starting with BLDR-).

• Scenario: Veeam Backup & Replication Data Processing

  • Context: The Veeam backup service (Veeam.Backup.Service.exe) performs data deduplication and compression tasks that involve reading and writing large chunks of data, which the YARA rule interprets as a potential “Fusion” attack vector.
  • Filter/Exclusion: Apply a filter to suppress alerts for Veeam.Backup.Service.exe when the file path contains \Program Files\Veeam\Backup & Replication\, specifically during active backup