Olyx Identifying Strings

Hunt Hypothesis

This detection rule identifies specific identifying strings associated with Olyx activity to uncover potential reconnaissance or initial access behaviors within the Azure environment. Proactively hunting for these signatures allows the SOC team to validate legitimate operational patterns and distinguish them from anomalous adversary movements before they escalate into higher-severity incidents.

YARA Rule

rule OlyxStrings : Olyx Family
{
    meta:
        description = "Olyx Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    strings:
        $ = "/Applications/Automator.app/Contents/MacOS/DockLight"
       
    condition:
        any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Olyx Identifying Strings detection rule in an enterprise environment, including targeted filters and exclusions:

• Endpoint Protection Health Checks

  • Scenario: The Olyx agent (or a companion management console like CrowdStrike Falcon or Microsoft Defender) performs routine integrity scans where it reads its own configuration files or signature databases. These files often contain hardcoded “Olyx” branding strings, version identifiers, and license keys that match the detection logic during normal read operations.
  • Suggested Filter: Exclude file paths located in standard installation directories (e.g., C:\Program Files\Olyx\, C:\Windows\System32\OlyxAgent\) and restrict alerts to processes running under the specific service account (e.g., NT SERVICE\OlyxService or Local System).

• Automated Patch Management Deployments

  • Scenario: During scheduled maintenance windows, tools like Microsoft SCCM, Ivanti, or Ansible deploy updates to the Olyx suite. The deployment scripts extract installation packages (MSI/EXE) which contain embedded identifying strings. The extraction process triggers the rule as it writes these string-rich files to temporary staging folders before installation.
  • Suggested Filter: Create an exclusion for processes known to be part of the patching infrastructure (e.g., ccmexec.exe, IvantiAgent.exe, ansible-playbook) and limit the scope to file extensions associated with installers (.msi, .cab, .exe) within temporary directories (C:\Windows\Temp\).

• Log Aggregation and SIEM Forwarding

  • Scenario: Enterprise logging solutions such as Splunk Universal Forwarder, Datadog Agent, or ELK Stack (Filebeat) ingest