FSGv110EngbartxtWinRARSFX

Hunt Hypothesis

This detection identifies potential malicious activity involving specific Windows RAR/SFX executable patterns that may indicate the presence of embedded archives or self-extracting installers often used in supply chain attacks. Proactive hunting for this behavior is essential to uncover early-stage threats where adversaries leverage legitimate compression tools to obfuscate payloads and evade standard signature-based defenses within the Azure Sentinel environment.

YARA Rule

rule FSGv110EngbartxtWinRARSFX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 }
	$a1 = { EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the FSGv110EngbartxtWinRARSFX YARA rule, along with targeted filters and exclusions:

• Scenario: Automated Backup Execution via Veeam or Commvault

  • Context: Enterprise backup agents (e.g., Veeam Agent, Commvault Command Center) frequently extract .rar or .sfx archives containing configuration scripts or agent updates during scheduled nightly windows. The YARA rule may flag the extraction process as a suspicious archive execution.
  • Filter/Exclusion: Exclude processes matching VeeamAgent.exe, CommServe.exe, and their child processes when running under the service account NT SERVICE\Veeam or specific backup service accounts. Add a path exclusion for the installation directory: C:\Program Files\VEEAM\Backup & Replication\....

• Scenario: Software Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: During application deployments, SCCM often utilizes self-extracting archives (.sfx) to distribute patches or new software versions. The rule triggers when the SCCM client (ccmsetup.exe) launches a temporary extraction tool that matches the RAR/SFX signature.
  • Filter/Exclusion: Create an exclusion for process trees originating from CcmExec.exe and WUAHandler.exe. Filter events where the parent process is ccmsetup.exe and the file path contains \CCM\Logs or \ContentLib.

• Scenario: Scheduled System Maintenance by Sysinternals PsExec

  • Context: IT administrators use scheduled tasks to run maintenance scripts via PsExec.exe, which often involves unpacking RAR archives containing PowerShell scripts or configuration files. The rule detects the extraction activity as a potential threat vector.
  • **Filter/Exclusion