This rule detects the presence of the Safe20 YARA signature, which typically identifies specific benign or low-risk software artifacts that may be leveraged by adversaries for living-off-the-land techniques or to establish a foothold in the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to distinguish between expected application usage and potential misuse, ensuring that low-severity detections are contextualized to avoid alert fatigue while catching subtle deviations in host behavior.
rule Safe20
{
meta:
author="malware-lu"
strings:
$a0 = { 83 EC 10 53 56 57 E8 C4 01 00 }
condition:
$a0
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: A developer or DevOps engineer uses Visual Studio Code (or similar IDEs like JetBrains Rider) to edit configuration files (e.g., .yaml, .json, .xml) in a local workspace. The YARA rule Safe20 may match specific string patterns or structural headers in these text-based config files, triggering an alert on the editor process (code.exe or idea64.exe).
code.exe, idea64.exe, devenv.exe) and the file extension is in a whitelist of text/config formats (.yaml, .yml, .json, .xml, .ini).Scenario: An IT administrator runs PowerShell to execute a standard maintenance script (e.g., Update-Service or Restart-Computer) that reads or writes to a specific system file or registry key that matches the byte pattern defined in Safe20. This is common during patching cycles or service restarts.
powershell.exe or pwsh.exe and the command line contains known administrative verbs (e.g., Update-, Restart-, Get-Service) or is executed from a trusted system directory (e.g., C:\Windows\System32\WindowsPowerShell\v1.0\).Scenario: A scheduled task runs 7-Zip (7z.exe) or WinRAR (WinRAR.exe) to compress or extract log files or backup archives. The YARA rule may match the archive header or specific embedded metadata strings within the compressed file structure, causing a false positive on the archiver process.