Quarian code features

Hunt Hypothesis

This detection identifies anomalous patterns associated with Quarian code features that may indicate early-stage reconnaissance or lateral movement by adversaries exploiting specific Azure workloads. Proactively hunting for these signals in Azure Sentinel allows the SOC team to validate potential false positives and refine baseline behaviors before they escalate into higher-severity incidents.

YARA Rule

rule QuarianCode : Quarian Family 
{
    meta:
        description = "Quarian code features"
        author = "Seth Hardy"
        last_modified = "2014-07-09"
    
    strings:
        // decrypt in intelnat.sys
        $ = { C1 E? 04 8B ?? F? C1 E? 05 33 C? }
        // decrypt in mswsocket.dll
        $ = { C1 EF 05 C1 E3 04 33 FB }
        $ = { 33 D8 81 EE 47 86 C8 61 }
        // loop in msupdate.dll
        $ = { FF 45 E8 81 45 EC CC 00 00 00 E9 95 FE FF FF }
    
    condition:
        any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Quarian code features” detection rule in an enterprise environment, including suggested filters and exclusions:

• Automated CI/CD Pipeline Artifact Generation

  • Scenario: The build server (e.g., Jenkins or GitLab Runner) executes a scheduled nightly job to compile source code and generate binary artifacts. During the compilation phase, the build agent creates temporary files with specific metadata signatures that mimic “Quarian code features” as part of the standard packaging process.
  • Filter/Exclusion: Exclude traffic originating from known CI/CD hostnames (e.g., *.jenkins.internal, gitlab-runner-01) and restrict the rule to only trigger on user-initiated sessions, excluding service accounts running under the “BuildAgent” identity.

• Enterprise Endpoint Protection Scanning

  • Scenario: The corporate antivirus solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a deep heuristic scan of developer workstations. When scanning large repositories containing legacy codebases, the scanner’s engine generates feature flags and temporary analysis logs that match the detection logic for Quarian code characteristics.
  • Filter/Exclusion: Create an exclusion rule based on process names associated with the EDR agent (e.g., csagent.exe, MsMpEng.exe) and filter out events where the parent process is identified as a scheduled maintenance task rather than an interactive user session.

• Database Schema Migration Scripts

  • Scenario: The Database Administration team runs automated migration scripts using tools like Liquibase or Flyway during off-peak hours (e.g., Sunday 2:00 AM). These scripts parse and validate database schema definitions, generating transaction logs with specific code feature identifiers that trigger the rule as “active” development activity.
  • Filter/Exclusion: Exclude events occurring within the defined