ProxyTool1

Hunt Hypothesis

This detection identifies adversary use of ProxyTool1 to establish covert command-and-control channels or exfiltrate data through proxy infrastructure within the Azure environment. Proactively hunting for this behavior is essential because its low severity classification may cause it to be overlooked in standard alerting, allowing stealthy lateral movement or initial foothold establishment to go unnoticed until a breach occurs.

YARA Rule

rule ProxyTool1
{
	strings:
		$STR1 = "pmsconfig.msi" wide
		$STR2 = "pmslog.msi" wide
	
	condition:
		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ProxyTool1 detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: The System Center Configuration Manager (SCCM) or Microsoft Intune agents frequently execute msiexec.exe or setup.exe processes that spawn child processes to download updates. These tools often utilize local proxy configurations to route traffic through the corporate gateway, triggering the YARA signature which looks for proxy manipulation behavior.
  • Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the command line contains specific deployment paths such as C:\Windows\CCM\.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint protection suites like CrowdStrike, SentinelOne, or Symantec run scheduled jobs (e.g., at 02:00 AM) to fetch the latest virus definitions. These agents often create temporary proxy configurations or modify local proxy settings (netsh winhttp) to ensure high-priority update traffic bypasses standard firewall rules, matching the ProxyTool1 logic.
  • Filter/Exclusion: Create a rule exclusion for known antivirus service executables (e.g., C:\Program Files\CrowdStrike\csagent.exe, C:\Program Files\Symantec Endpoint Protection\Symantec Endpoint Protection\Smc.exe) running during maintenance windows (01:00–04:00).

• Scenario: Enterprise Browser Auto-Configuration Scripts

  • Context: IT administrators deploy Group Policy Objects (GPO) that push PAC (Proxy Auto-Config) scripts to user machines. When users log in or when the gpupdate command runs,