Strings used by SafeNet

Hunt Hypothesis

This detection identifies legitimate cryptographic operations performed by SafeNet software to establish a baseline of expected string patterns within the environment. Proactively hunting for these specific strings in Azure Sentinel allows the SOC team to distinguish normal encryption activities from potential anomalies or masquerading adversaries attempting to mimic trusted security tools.

YARA Rule

rule SafeNetStrings : SafeNet Family
{
    meta:
        description = "Strings used by SafeNet"
        author = "Seth Hardy"
        last_modified = "2014-07-16"
        
    strings:
        $ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr"
        $ = "/safe/record.php"
        $ = "_Rm.bat" wide ascii
        $ = "try\x0d\x0a\x09\x09\x09\x09  del %s" wide ascii
        $ = "Ext.org" wide ascii
        
    condition:
        any of them

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Strings used by SafeNet detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Certificate Renewal Jobs

  • Scenario: The SafeNet Authentication Server (or Luna HSM) runs a nightly scheduled task (e.g., via Windows Task Scheduler or cron) to check certificate expiration dates and rotate keys. This process generates high-volume string-based logs indicating “certificate validation” or “key rotation” events that mimic suspicious activity.
  • Filter/Exclusion: Exclude alerts where the source user is a dedicated service account (e.g., svc_safenet_renewal) AND the event occurs within the maintenance window (e.g., 02:00–04:00 UTC). Additionally, filter by process name SafeNetKeyManager.exe or specific scheduled task IDs.

• Luna Client Driver Installation and Updates

  • Scenario: During a patch Tuesday cycle, the IT team deploys updates to the SafeNet Luna Client software across hundreds of workstations via SCCM or Intune. The installation process triggers multiple “string usage” events as the driver initializes communication with the HSM and registers new cryptographic providers.
  • Filter/Exclusion: Create an exclusion for the specific executable path C:\Program Files\SafeNet\Luna Client\bin\lunaprov.exe (or similar) when the parent process is a known deployment tool like ccmexec.exe (SCCM) or OneDriveStandaloneUpdater.exe.

• Database Backup and Recovery Operations

  • Scenario: Enterprise databases (e.g., SQL Server, Oracle) utilize SafeNet HSMs to encrypt backup streams. During the daily full backup window, the database engine invokes SafeNet libraries to manage encryption keys, generating a burst of “strings used