identifiers for gmremote: surtr stage 2

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging GMRemote during the SURTR Stage 2 phase to establish persistent remote access channels within the environment. Proactively hunting for these specific identifiers in Azure Sentinel is critical to detect early-stage lateral movement and validate the legitimacy of remote sessions before they evolve into more severe threats.

YARA Rule

rule GmRemoteStrings : GmRemote Variant Family Surtr {
	meta:
		description = "identifiers for gmremote: surtr stage 2"
		author = "Katie Kleemola"
		last_updated = "07-21-2014"
	
	strings:
		$ = "\x00x86_GmRemote.dll\x00"
		$ = "\x00D:\\Project\\GTProject\\Public\\List\\ListManager.cpp\x00"
		$ = "\x00GmShutPoint\x00"
		$ = "\x00GmRecvPoint\x00"
		$ = "\x00GmInitPoint\x00"
		$ = "\x00GmVerPoint\x00"
		$ = "\x00GmNumPoint\x00"
		$ = "_Gt_Remote_" wide
		$ = "%sBurn\\workdll.tmp" wide
	
	condition:
		any of them

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the identifiers for gmremote: surtr stage 2 detection rule within an enterprise environment, along with suggested filters or exclusions:

• Scheduled GMS Backup and Sync Jobs

  • Scenario: The enterprise runs nightly automated backups of the Global Management System (GMS) using tools like Veeam Backup & Replication or native Windows Task Scheduler. These jobs trigger gmremote service calls to verify data integrity during the “SURTR Stage 2” synchronization phase, generating high-volume traffic that mimics active user sessions.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from specific backup server IP ranges (e.g., 10.50.20.0/24) during the maintenance window of 02:00 – 06:00 UTC. Additionally, filter for process names matching vbrservice.exe or svchost.exe with the specific command line argument -sync-stage-2.

• Administrative Configuration Push via SCCM

  • Scenario: System Administrators use Microsoft Endpoint Configuration Manager (SCCM) to push critical configuration updates and policy changes to the GMS infrastructure. During these deployment windows, the gmremote service initiates a “SURTR Stage 2” handshake to validate the new configuration state before applying it, often appearing as an anomalous remote access event.
  • Filter/Exclusion: Exclude events where the source user account is a known service principal (e.g., svc-sccm-deploy or admin-gms-config) and the destination port corresponds to the SCCM management point. Add a filter for the specific application identifier SMS_EXEC_HOST initiating the connection.

• Third-Party Security Scanning (Tenable/Nessus)

  ---