This detection identifies the presence of SafeDisc virtual drive software, which adversaries often leverage to obfuscate malicious payloads or establish a persistent foothold within the endpoint environment. The SOC team should proactively hunt for this indicator in Azure Sentinel to validate legitimate usage and uncover potential misuse where attackers exploit these virtual drives to hide suspicious artifacts from standard monitoring tools.
rule SafeDiscv4
{
meta:
author="malware-lu"
strings:
$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F }
condition:
$a0
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the SafeDiscv4 detection rule in an enterprise environment, along with suggested filters and exclusions:
Scenario: Legacy Software Installation via SCCM
SafeDisc executable (safedisc.exe) is launched to mount the virtual drive and apply license checks.C:\Program Files\Microsoft Configuration Manager\Components\SafeDisc\safedisc.exe. Additionally, add an exception for process trees where the parent process is ccmsetup.exe or wuauserv.exe (Windows Update Agent) during business hours.Scenario: Scheduled Antivirus Definition Updates
safedisc.exe running under the context of the specific AV service account (e.g., NT SERVICE\Symantec Antivirus). Implement a time-based filter to suppress alerts for this rule between 02:00 and 04:00 UTC, coinciding with the maintenance window.Scenario: Virtual Desktop Infrastructure (VDI) Boot Sequence