searchinject

Hunt Hypothesis

This detection targets adversaries utilizing the searchinject mechanism to inject malicious payloads into legitimate search processes, potentially establishing persistence or executing code in memory. Proactive hunting for this behavior in Azure Sentinel is critical because its low severity classification may cause it to be overlooked during routine alert triage, allowing stealthy initial access attempts to go unchallenged before escalating into a broader compromise.

YARA Rule

rule searchinject
{
meta:
	author = "@patrickrolsen"
	reference = "Usage: SearchInject <PID1>[PID2][PID3] - It loads Searcher.dll (appears to be hard coded)"
strings:
	$s1 = "SearchInject"
	$s2 = "inject base:"
	$s3 = "Searcher.dll" nocase
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• Usage: SearchInject [PID2][PID3] - It loads Searcher.dll (appears to be hard coded)
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the searchindex detection rule in an enterprise environment, along with suggested filters and exclusions:

• Scenario: Microsoft Office Background Indexing

  • Context: The Windows Search service (SearchIndexer.exe) or Microsoft Office components (e.g., OfficeClickToRun.exe) frequently inject code into user sessions to index documents for “Search” functionality. This behavior mimics the injection patterns targeted by the rule, especially during large file scans or initial indexing after a system update.
  • Suggested Filter/Exclusion: Create an exclusion based on the parent process name SearchIndexer.exe and OfficeClickToRun.exe. Additionally, filter out events where the injected module path contains \Program Files\Windows Search\ or \Microsoft Office\root\.

• Scenario: Endpoint Detection & Response (EDR) Real-Time Scanning

  • Context: Security agents like CrowdStrike Falcon (csfalcon.exe) or SentinelOne (s1agent.exe) often inject their own scanning modules into active processes to perform real-time heuristic analysis. This legitimate “self-injection” for security monitoring can trigger the searchinject rule, particularly when the agent scans a process that is already handling search queries.
  • Suggested Filter/Exclusion: Exclude events where the parent process is known EDR binaries (e.g., csfalcon.exe, s1agent.exe, CarbonBlackAgent.exe). Implement a filter to ignore injections originating from the specific hash of the EDR agent’s core injection DLL.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: During scheduled maintenance windows, antivirus solutions such as Symantec Endpoint Protection (Symantec AntiVirus service) or McAfee Enterprise perform background updates that involve injecting new signature definitions into the memory of running services to