FSGv110Engdulekxt

Hunt Hypothesis

This YARA rule targets specific file signatures associated with the FSGv110Engdulekxt artifact, indicating the presence of a known low-severity threat component or benign file variant within the environment. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify and triage these files early, ensuring they are correctly classified and preventing potential misattributions or overlooked low-fidelity indicators of compromise.

YARA Rule

rule FSGv110Engdulekxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 ?? BF ?? 10 40 ?? BE }
	$a1 = { E8 01 00 00 00 [2] E8 ?? 00 00 00 }
	$a2 = { EB 01 ?? EB 02 [3] 80 [2] 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy .NET application or internal tool (e.g., a custom inventory management system) is compiled with an older version of the .NET Framework, resulting in a binary that contains specific metadata strings or resource sections matching the YARA pattern.

  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\InternalTools\InventoryApp\) or exclude binaries with a specific Product Name in the PE header that matches the known internal tool.

• Scenario: A scheduled maintenance job runs a third-party backup utility (e.g., Veeam Backup & Replication agent or Acronis True Image) that loads a helper DLL or executable containing the specific byte sequence or string pattern targeted by the rule.

  • Filter/Exclusion: Exclude processes or files whose parent process is a known backup service (e.g., VeeamBackupSvc.exe or AcronisService.exe) or exclude files with a specific SHA256 hash known to be part of the backup suite.

• Scenario: A developer or IT admin uses a legitimate code obfuscation or packing tool (e.g., UPX, Enigma Protector, or a custom internal packer) to compress a small utility script or helper executable before deployment to test servers.

  • Filter/Exclusion: Exclude files that have a specific file extension (e.g., .packed or .obf) or exclude files located in a designated “Staging” or “DevOps” directory (e.g., C:\DevOps\Staging\) where packed binaries are temporarily stored.

• Scenario: A standard Windows system update or hotfix (e.g., a specific KB patch for .NET or Windows Core) installs a system DLL or executable that inadvertently matches the YARA pattern due to a common compiler artifact or shared library dependency.