PolyBox C Anskya

Hunt Hypothesis

This hypothesis targets the execution of PolyBox C Anskya, a low-severity YARA signature often associated with specific malware families or obfuscated payloads that may evade standard behavioral detections. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify early-stage compromises or persistent threats that leverage known code patterns before they escalate to more impactful post-exploitation activities.

YARA Rule

rule PolyBox_C_Anskya: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF }
        $b = { 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses PolyBox (a popular open-source tool for managing polyfills or bundling assets in web applications) within a CI/CD pipeline or local build environment. The Anskya component (likely a specific module, plugin, or obfuscated string signature within the PolyBox ecosystem) is loaded during the npm install or yarn build process, triggering the YARA rule on the executable or script file.

  • Filter/Exclusion: Exclude files located in standard node_modules directories (e.g., C:\Projects\*\node_modules\polybox\* or D:\CI\builds\*\node_modules\polybox\*) and processes spawned by node.exe or npm.cmd when the parent process is a known build tool (e.g., jenkins.exe, gitlab-runner.exe, or docker.exe).

• Scenario: An IT administrator performs a scheduled maintenance task using PolyBox to scan or patch legacy web applications that rely on older JavaScript polyfills. The tool is executed via a scheduled task named “Legacy Web App Patching” and loads the Anskya module to analyze compatibility, causing the YARA rule to fire on the temporary working directory or the main executable.

  • Filter/Exclusion: Exclude processes where the parent process is schtasks.exe or taskeng.exe and the command line contains “polybox” or “anskya”. Additionally, exclude files in the specific maintenance directory (e.g., C:\AdminTools\PolyBox\) if the process owner is a known service account (e.g., DOMAIN\svc-maintenance).

• Scenario: A security team conducts a periodic vulnerability assessment using PolyBox in “audit mode” to identify missing polyfills in internal web services. The tool is run from a