Quarian Identifying Strings

Hunt Hypothesis

This detection rule identifies specific identifying strings associated with the Quarian adversary to uncover potential reconnaissance or initial access activities within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to establish a baseline of known benign patterns and rapidly detect deviations that may signal early-stage threat actor presence before escalation occurs.

YARA Rule

rule QuarianStrings : Quarian Family
{
    meta:
        description = "Quarian Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-07-09"
        
    strings:
        $ = "s061779s061750"
        $ = "[OnUpLoadFile]"
        $ = "[OnDownLoadFile]"
        $ = "[FileTransfer]"
        $ = "---- Not connect the Manager, so start UnInstall ----"
        $ = "------- Enter CompressDownLoadDir ---------"
        $ = "------- Enter DownLoadDirectory ---------"
        $ = "[HandleAdditionalData]"
        $ = "[mswsocket.dll]"
        $ = "msupdate.dll........Enter ThreadCmd!"
        $ = "ok1-1"
        $ = "msupdate_tmp.dll"
        $ = "replace Rpcss.dll successfully!"
        $ = "f:\\loadhiddendriver-mdl\\objfre_win7_x86\\i386\\intelnat.pdb"
        $ = "\\drivercashe\\" wide ascii
        $ = "\\microsoft\\windwos\\" wide ascii
        $ = "\\DosDevices\\LOADHIDDENDRIVER" wide ascii
        $ = "\\Device\\LOADHIDDENDRIVER" wide ascii
        $ = "Global\\state_maping" wide ascii
        $ = "E:\\Code\\2.0\\2.0_multi-port\\2.0\\ServerInstall_New-2010-0913_sp3\\msupdataDll\\Release\\msupdate_tmp.pdb"
        $ = "Global\\unInstall_event_1554_Ower" wide ascii
        
    condition:
       any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Quarian Identifying Strings detection rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Backup Agent Heartbeats

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault frequently inject unique identification strings into their log streams to track job integrity. These agents run scheduled tasks every 15 minutes that write “Quarian-Identify-[UUID]” markers to the System event log on domain controllers, mimicking a potential lateral movement signature.
  • Filter/Exclusion: Create an exclusion rule for events originating from specific Service Accounts (e.g., svc_veeam_backup) or processes named VeeamAgent.exe and SimpanaService.exe. Additionally, filter out log entries containing the substring “Scheduled-Heartbeat” in the message body.

• Endpoint Detection & Response (EDR) Policy Updates

  • Scenario: When CrowdStrike Falcon or SentinelOne pushes a new policy update to endpoints, the agent daemon writes diagnostic logs containing specific identifying strings to verify the configuration hash. During peak deployment windows (e.g., Tuesday 02:00 UTC), thousands of workstations simultaneously generate these “Quarian-Identify” strings as they validate the new security posture, triggering high-volume alerts.
  • Filter/Exclusion: Exclude events where the source process is FalconSensor.exe or SentinelOneAgent.exe. Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 01:00–04:00 UTC) for these specific processes.

• Identity Management Synchronization Jobs

  • Scenario: Microsoft Azure AD Connect or Okta Identity Engine performs hourly synchronization cycles between on-premise Active