SafeNet code features

Hunt Hypothesis

This detection rule identifies specific SafeNet code execution patterns that may indicate legitimate cryptographic operations or subtle anomalies within the software supply chain. Proactively hunting for these features in Azure Sentinel allows the SOC team to establish a behavioral baseline and distinguish between normal SafeNet activity and potential early-stage compromise attempts before they escalate into critical incidents.

YARA Rule

rule SafeNetCode : SafeNet Family 
{
    meta:
        description = "SafeNet code features"
        author = "Seth Hardy"
        last_modified = "2014-07-16"
        
    strings:
        // add edi, 14h; cmp edi, 50D0F8h
        $ = { 83 C7 14 81 FF F8 D0 40 00 }
    condition:
        any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SafeNet Code Features detection rule in an enterprise environment, along with targeted filtering strategies:

• Automated License Renewal via SafeKey Management Server

  • Scenario: The nightly scheduled job on the central SafeKey Management Server (SKMS) triggers a bulk license renewal or key rotation process. This involves the SafeNet Sentinel service reading and writing to the code feature registry, generating high-volume events that mimic suspicious code execution patterns due to the cryptographic operations involved.
  • Filter/Exclusion: Exclude events originating from the specific SKMS server hostname (e.g., skms-prod-01.corp.local) where the process name is SentinelLicensing.exe and the user context is the local system account (NT AUTHORITY\SYSTEM).

• Endpoint Deployment of SafeNet Authentication Client

  • Scenario: During a scheduled maintenance window, the IT Operations team deploys an update to the SafeNet Authentication Client across 500+ workstations using Microsoft Endpoint Configuration Manager (MECM/SCCM). The installation service (ccmexec.exe) invokes the SafeNet installer, which registers new code features and updates the local registry, triggering the rule on every affected machine.
  • Filter/Exclusion: Create a filter to suppress alerts where the parent process is ccmexec.exe or msiexec.exe, and the command line arguments contain keywords such as /qn, SafeNet, or AuthenticationClient.

• Database Backup Integration with SafeNet Key Secure

  • Scenario: The enterprise database team runs a daily encrypted backup of critical SQL Server instances using Veeam Backup & Replication. This workflow utilizes the SafeNet Key Secure API to encrypt data streams, causing the vbrservice.exe process to interact heavily with SafeNet code features (specifically