Used to detect FastPOS keyloggger + scraper

Hunt Hypothesis

This hunt targets adversaries deploying the FastPOS malware to simultaneously capture keystrokes and scrape sensitive data from endpoints within the Azure Sentinel environment. Proactively searching for this specific combination of behaviors is essential because early detection of these low-severity activities can prevent the exfiltration of critical credentials before they are compromised at scale.

YARA Rule

rule PoS_Malware_fastpos : FastPOS POS keylogger
{
meta:
author = "Trend Micro, Inc."
date = "2016-05-18"
description = "Used to detect FastPOS keyloggger + scraper"
reference = "http://documents.trendmicro.com/assets/fastPOS-quick-and-easy-credit-card-theft.pdf"
sample_filetype = "exe"
strings:
$string1 = "uniqyeidclaxemain"
$string2 = "http://%s/cdosys.php"
$string3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
$string4 = "\\The Hook\\Release\\The Hook.pdb" nocase
condition:
all of ($string*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://documents.trendmicro.com/assets/fastPOS-quick-and-easy-credit-card-theft.pdf
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the FastPOS Keylogger + Scraper detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Agent Telemetry Collection

  • Scenario: The native telemetry service of endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) periodically scans running processes to identify key injection behaviors. When the agent’s background scanner (C:\Program Files\CrowdStrike\fsagent.exe or MsMpEng.exe) inspects a legitimate user session, it may mimic the memory footprint and API hooking patterns of the FastPOS scraper.
  • Filter/Exclusion: Exclude processes with known benign parent hashes (e.g., CrowdStrike’s fsagent.exe hash) or filter alerts where the process path resides within the vendor’s installation directory (C:\Program Files\*) rather than user-specific directories like %APPDATA%.

• Automated IT Asset Inventory Scans

  • Scenario: Scheduled inventory tools such as SolarWinds RMM, ManageEngine Desktop Central, or PDQ Deploy run daily to audit installed software and hardware configurations. These agents often inject hooks into the user’s input stream to capture active window titles and application usage metrics, which can trigger the “scraper” logic of the detection rule during their scheduled maintenance windows (e.g., 02:00–04:00 local time).
  • Filter/Exclusion: Create a time-based exclusion for alerts occurring between 01:00 and 05:00 on weekdays, or whitelist specific service accounts (e.g., DOMAIN\svc_inventory_agent) that execute these inventory tasks.

• Remote Support Session Initialization

  • Scenario: When IT helpdesk technicians initiate remote support sessions using