GardianAngel10

Hunt Hypothesis

This YARA rule targets the specific memory footprint or binary characteristics of the GardianAngel10 component, a tool often associated with process injection or anti-forensics capabilities used by adversaries to maintain persistence. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify low-severity, stealthy implantations that may be leveraging legitimate system processes to evade standard behavioral detections.

YARA Rule

rule GardianAngel10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 8C C8 8E D8 8E C0 FC BF [2] EB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A security team deploys a custom PowerShell script to perform a bulk “Get-Process” audit across all endpoints to identify high-memory consumers. The script explicitly calls Get-Process in a loop or pipeline, which matches the YARA pattern for process enumeration.
  • Filter/Exclusion: Exclude alerts where the parent process is powershell.exe or pwsh.exe and the command line contains specific audit keywords (e.g., -Audit, -MemoryCheck) or originates from a known admin share path (e.g., \\fileserver\tools\).
• Scenario: An IT administrator runs the native Windows tool tasklist.exe via a scheduled task (Task Scheduler) to generate daily system health reports. The YARA rule triggers because tasklist is a standard process enumeration command often flagged in low-fidelity detections.
  • Filter/Exclusion: Exclude alerts where the image path is C:\Windows\System32\tasklist.exe and the parent process is svchost.exe (specifically the Task Scheduler service) or TaskScheduler.exe, provided the working directory is a standard system or admin directory.
• Scenario: A DevOps engineer uses the psutil Python library within a monitoring agent (e.g., a custom Zabbix or Nagios plugin) to collect CPU and memory metrics. The underlying C-extension or Python script invokes system calls that the YARA rule interprets as process listing.
  • Filter/Exclusion: Exclude alerts where the parent process is python.exe or python3.exe and the command line contains psutil, monitoring, or agent, or where the user account belongs to a service group like svc_monitoring.
• Scenario: A backup solution (e.g., Veeam or Commvault) initiates a snapshot operation that temporarily enumer