File Analyzer Registration file v10 additional

Hunt Hypothesis

This rule identifies the presence of specific registration files associated with file analyzer tools, which adversaries may deploy to facilitate data staging or exfiltration preparation. Proactively hunting for these artifacts allows the SOC to detect early-stage reconnaissance or tooling deployment that might otherwise go unnoticed until more aggressive actions occur.

YARA Rule

rule File_Analyzer_Registration_file_v10_additional: PEiD
{
    strings:
        $a = { 24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Enterprise Endpoint Detection and Response (EDR) agents (e.g., CrowdStrike Falcon, Carbon Black, or Microsoft Defender for Endpoint) install or update their local file scanning modules. These agents often drop temporary analysis files or registration keys in standard system directories (like %ProgramFiles% or C:\ProgramData) that match the “additional” registration file signature.

  • Filter/Exclusion: Exclude paths containing \CrowdStrike\, \CarbonBlack\, or \Microsoft\Defender\ and filter by process names like csagent.exe, cb.exe, or MsMpEng.exe.

• Scenario: Scheduled maintenance jobs for antivirus or data loss prevention (DLP) solutions (e.g., Symantec Endpoint Protection, McAfee, or Zscaler DLP) perform full disk scans or policy updates. During these operations, the software may write temporary registration or state files to the user’s temp directory (%TEMP%) or local app data, triggering the YARA rule if the file structure matches the v10 additional pattern.

  • Filter/Exclusion: Exclude processes associated with AV/DLP services (e.g., ccSvcHst.exe for Symantec, mfe.exe for McAfee) and filter file paths under %LOCALAPPDATA%\Temp or %APPDATA% when the parent process is a known security service.

• Scenario: IT administrators manually deploy or update third-party file integrity monitoring (FIM) tools (e.g., Ossec, Wazuh, or Tripwire) via Group Policy or deployment scripts. The installation or configuration step may create a registration file in the tool’s default installation directory (e.g., C:\Program Files\Wazuh\ or C:\ossec\) that matches the YARA signature.

  • Filter/Exclusion: Exclude