FSGv20

Hunt Hypothesis

This rule detects the presence of specific file signatures associated with the FSGv20 YARA pattern, which may indicate the execution of known malware or suspicious scripts within the environment. Proactively hunting for these signatures in Azure Sentinel allows the SOC team to identify low-severity threats that may have been missed by standard detections, ensuring early containment of potential initial access or persistence mechanisms.

YARA Rule

rule FSGv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 87 25 [4] 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer is compiling a large C/C++ project using gcc or clang with optimization flags (e.g., -O2 or -O3) on a build server or developer workstation. The compiler generates highly optimized machine code that may exhibit repetitive instruction patterns or specific byte sequences matching the FSGv20 signature, particularly if the rule targets common packing or obfuscation artifacts found in optimized binaries.

  • Filter/Exclusion: Exclude processes where the parent process is gcc.exe, clang.exe, msbuild.exe, or dotnet.exe, and the file path contains /build/, /obj/, or /bin/Debug/. Additionally, exclude files with extensions .obj, .o, or .so located in standard build directories.

• Scenario: An IT administrator is performing a routine backup or snapshot operation using tools like Veeam, Windows Server Backup, or rsync on a file server. During the deduplication or compression phase, the tool may create temporary files or intermediate compressed archives (e.g., .vbk, .tar.gz, .zip) that contain dense, repetitive data blocks. If FSGv20 detects high-entropy or specific repetitive byte patterns, these legitimate compressed backups could trigger the rule.

  • Filter/Exclusion: Exclude processes with names like VeeamBackup.exe, wbadmin.exe, rsync.exe, or 7z.exe. Filter out files with extensions .vbk, .tar, .gz, .zip, or .7z located in standard backup directories such as C:\Backups\, \\fileserver\backups\, or /var/backups/.

• Scenario: A security team or application developer is using a legitimate packer or obfuscator tool (e.g