MSLRHv032afakenSPack13emadicius

Hunt Hypothesis

This detection identifies the presence of a specific malware signature associated with the “fakenSPack13” variant, which often indicates early-stage reconnaissance or lateral movement activities by adversaries leveraging custom payloads. Proactive hunting for this indicator within Azure Sentinel is essential to uncover low-severity infections that may evade standard alerting thresholds but could serve as precursors to more significant compromise events if left unaddressed.

YARA Rule

rule MSLRHv032afakenSPack13emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule MSLRHv032afakenSPack13emadicius, along with suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: The YARA rule detects a known signature within the msrt.exe (Microsoft Safety Scanner) or similar security agent process when it performs nightly definition updates. In many enterprise environments, tools like Microsoft Defender for Endpoint or Symantec Endpoint Protection trigger this specific payload during their scheduled maintenance window (e.g., 02:00 AM daily).
  • Suggested Filter/Exclusion: Create a time-based exclusion to suppress alerts generated between 01:00 and 04:00 local time for the process msrt.exe or the specific update service executable (e.g., MpCmdRun.exe) running under the SYSTEM account.

• Scenario: Legitimate Software Deployment via SCCM/Intune

  • Context: The rule triggers when the Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune deploys a new application package to workstations. During the installation phase, the deployment agent often extracts temporary files that match the YARA signature, particularly when distributing security tools or patching suites like Patch My PC.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is ccmsetup.exe (SCCM) or IntuneManagementExtension.exe, and the file path contains standard deployment directories such as C:\Windows\CCMCache or C:\ProgramData\Microsoft\Intune Management Extension.

• Scenario: Admin-Initiated Manual Security Scans

  • Context: System administrators frequently run manual on-demand scans using Microsoft Safety Scanner (MSRT)