DNSCalcStyleEncodeAndDecode

Hunt Hypothesis

This detection identifies adversary behavior where malware utilizes custom encoding and decoding mechanisms within DNS traffic to establish covert command-and-control channels or exfiltrate data without triggering standard signature-based alerts. The SOC team should proactively hunt for this pattern in Azure Sentinel because low-severity, logic-driven anomalies often indicate early-stage reconnaissance or persistent threats that evade traditional perimeter defenses by mimicking legitimate DNS query structures.

YARA Rule

rule DNSCalcStyleEncodeAndDecode: sharedcode
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "975522bc3e07f7aa2c4a5457e6cc16c49a148b9f731134b8971983225835577e"

	strings:
	/*
		8A 10     mov     dl, [eax]
		80 F2 73  xor     dl, 73h					<--- for decoding and encoding, this and
		80 EA 3A  sub     dl, 3Ah					<--- this could be reversed, but the sig holds since both are 0x80
		88 10     mov     [eax], dl
		40        inc     eax
		49        dec     ecx
		75 F2     jnz     short loc_1000403C
	*/

	$a = {8A ?? 80 ?? ?? 80 ?? ?? 88 ?? 4? 4? 75 ?? }

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the DNSCalcStyleEncodeAndDecode detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Microsoft Office Click-to-Run Deployment Updates

  • Scenario: The OfficeClickToRun.exe service frequently performs background health checks and license validation. It utilizes a custom encoding scheme to obfuscate communication with Microsoft’s update servers, which mimics the “Calc-style” mathematical string manipulation detected by the YARA rule. This often occurs during scheduled maintenance windows (e.g., 2:00 AM) or immediately after a patch Tuesday deployment.
  • Suggested Filter/Exclusion: Create an exclusion for the process path C:\Program Files\Microsoft Office\Office16\ClickToRun.exe and its child processes (officeclicktorun.exe). Additionally, filter out DNS queries where the destination IP belongs to Microsoft’s Azure CDN ranges (e.g., 13.107.*.*) combined with a User-Agent string containing “MS-Cornerstone”.

• CrowdStrike Falcon Sensor Telemetry Uploads

  • Scenario: The CrowdStrike Falcon sensor (csfalcon.exe or csagent.exe) encodes system telemetry and host metadata before transmitting it to the Falcon Cloud. This encoding process involves specific string transformations that trigger the “EncodeAndDecode” signature, particularly when the sensor is performing a large-scale file integrity scan or uploading a new configuration policy.
  • Suggested Filter/Exclusion: Exclude network traffic originating from csfalcon.exe and csagent.exe destined for CrowdStrike cloud endpoints (e.g., *.crowdstrike.com). A specific filter could target DNS queries where the query name contains the substring _telemetry_ or matches a known CrowdStrike domain pattern.

• **Java-Based Enterprise Application Startup (e.g