FSG131dulekxt

Hunt Hypothesis

This YARA rule targets specific file signatures associated with the FSG131dulekxt indicator, potentially identifying low-severity malware or suspicious artifacts that may have been dropped during initial access or lateral movement. Proactively hunting for these signatures in Azure Sentinel allows the SOC team to detect dormant or stealthy threats that evade standard behavioral detections, ensuring early identification of compromised assets before they escalate in severity.

YARA Rule

rule FSG131dulekxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [3] 00 BF [3] 00 BB [3] 00 53 BB [3] 00 B2 80 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A DevOps engineer runs a standard docker build or docker run command to compile a microservice, where the container runtime creates temporary files or executes binaries in /tmp or /var/lib/docker/overlay2 that match the YARA signature for common build artifacts or shared libraries.
  • Filter/Exclusion: Exclude processes where the parent process is dockerd, containerd-shim, or runc, and where the file path contains /var/lib/docker/ or /tmp/ with a timestamp-based naming convention.
• Scenario: The enterprise backup agent (e.g., Veeam, Commvault, or Rubrik) performs a full file system scan and restores or verifies integrity of application binaries, causing the YARA rule to match against legitimate application executables (e.g., java.exe, node.exe, or custom .dll files) during the verification phase.
  • Filter/Exclusion: Exclude alerts where the process name matches known backup agents (VeeamBackup.exe, commvault_agent.exe, rubik_agent.exe) or where the file is located in standard backup staging directories (e.g., C:\ProgramData\Backup\, D:\BackupStaging\).
• Scenario: A scheduled Windows Task (Task Scheduler) runs a maintenance script (e.g., clean_temp.vbs or logrotate.bat) that temporarily moves or copies log files and configuration dumps to a local temp folder, triggering the YARA rule if the rule inspects file content or metadata of recently modified files in %TEMP% or %LOCALAPPDATA%.
  • Filter/Exclusion: Exclude events where the parent process is svchost.exe (specifically for Schedule service) or Taskeng.exe, and the file path contains %TEMP%, `%LOCALAPPDATA%\