regexpr pos

Hunt Hypothesis

This detection identifies adversary behavior characterized by specific regular expression patterns within process execution logs, potentially indicating reconnaissance or initial foothold activities. Proactively hunting for these patterns in Azure Sentinel allows the SOC team to uncover subtle indicators of compromise that may be missed by standard alerting due to their low severity classification.

YARA Rule

rule regexpr_pos
{
meta:
	author = "@patrickrolsen"
	reference = "POS malware - RegExpr"
strings:
	$s1 = "RegExpr" nocase
	$s2 = "Data.txt"
	$s3 = "Track1"
	$s4 = "Track2"
condition:
	uint16(0) == 0x5A4D and 3 of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• POS malware - RegExpr
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the regexpr_pos detection rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Antivirus Signature Updates

  • Scenario: The enterprise endpoint protection agent (e.g., CrowdStrike Falcon or Microsoft Defender) executes a scheduled task to download and parse new signature definitions. This process often involves reading large XML/JSON configuration files containing complex regular expressions, triggering the regexpr_pos logic during the parsing phase.
  • Filter/Exclusion: Create an exclusion for processes running under the specific service accounts (e.g., svc_antivirus) and restrict the rule to exclude file paths within the vendor’s installation directory (e.g., C:\Program Files\Microsoft Defender\Updates\).

• Database Index Maintenance Jobs

  • Scenario: A nightly maintenance job on a SQL Server or Oracle database server runs stored procedures that validate data integrity. These procedures frequently utilize complex regex patterns to sanitize and format column values (e.g., cleaning email addresses or phone numbers in bulk), causing the detection logic to fire repeatedly during high-volume batch processing windows.
  • Filter/Exclusion: Exclude the specific database engine processes (sqlservr.exe, oracle.exe) when they are executing known maintenance stored procedures, identified by command-line arguments containing keywords like -m (maintenance) or specific job IDs from SQL Agent logs.

• CI/CD Pipeline Artifact Validation

  • Scenario: During a deployment window, the Jenkins or GitLab Runner build agents execute unit tests and code quality scans (using tools like SonarQube). These scanners parse source code files to enforce naming conventions and syntax rules using heavy regex operations on thousands of lines of code simultaneously.
  • Filter/Exclusion: Whitelist the CI/CD