sendsafe

Hunt Hypothesis

This detection identifies potential data exfiltration or unauthorized file transfers by monitoring for specific “sendsafe” patterns that may indicate an adversary attempting to move sensitive assets out of the environment. The SOC team should proactively hunt for this behavior in Azure Sentinel to validate the legitimacy of these low-severity events and prevent subtle, long-term data leakage before it escalates into a significant breach.

YARA Rule

rule sendsafe {

    meta:
        author = " J from THL <j@techhelplist.com>"
        date = "2016/09"
        reference = "http://pastebin.com/WPWWs406"
		version = 2
        maltype = "Spammer"
        filetype = "memory"

    strings:
        $a = "Enterprise Mailing Service"
        $b = "Blacklisted by rule: %s:%s"
        $c = "/SuccessMails?CampaignNum=%ld"
        $d = "/TimedOutMails?CampaignNum=%ld"
        $e = "/InvalidMails?CampaignNum=%ld"
        $f = "Failed to download maillist, retrying"
        $g = "No maillist loaded"
        $h = "Successfully sent using SMTP account %s (%d of %ld messages to %s)"
        $i = "Successfully sent %d of %ld messages to %s"
        $j = "Sending to %s in the same connection"
        $k = "New connection required, will send to %s"
		$l = "Mail transaction for %s is over."
		$m = "Domain %s is bad (found in cache)"
		$n = "Domain %s found in cache"
		$o = "Domain %s isn't found in cache, resolving it"
		$p = "All tries to resolve %s failed."
		$q = "Failed to receive response for %s from DNS server"
		$r = "Got DNS server response: domain %s is bad"
		$s = "Got error %d in response for %s from DNS server"
		$t = "MX's IP for domain %s found in cache:"
		$u = "Timeout waiting for domain %s to be resolved"
		$v = "No valid MXes for domain %s. Marking it as bad"
		$w = "Resolving MX %s using existing connection to DNS server"
		$x = "All tries to resolve MX for %s are failed"
		$y = "Resolving MX %s using DNS server"
		$z = "Failed to receive response for MX %s from DNS server"

    condition:
        13 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 26 string patterns in its detection logic.

References

• http://pastebin.com/WPWWs406
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the sendsafe detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Enterprise Email Gateway Scanning

  • Context: The Microsoft Exchange Online Protection (EOP) or Proofpoint email gateway scans incoming and outgoing traffic. When these services process large attachments or perform deep content inspection, the sendsafe YARA signature may trigger on the legitimate scanning engine’s internal communication with the mail store.
  • Filter/Exclusion: Exclude network traffic originating from the specific IP subnets of the email gateway appliances (e.g., 10.20.30.0/24) or filter by process name ProofpointAgent.exe and Microsoft.Exchange.Transport.exe.

• Scenario: Scheduled Endpoint Protection Updates

  • Context: During nightly maintenance windows, endpoint security agents like CrowdStrike Falcon or SentinelOne push definition updates to workstations. The update mechanism often involves the temporary extraction of signed binaries that match the sendsafe heuristic patterns before they are fully integrated into the OS registry.
  • Filter/Exclusion: Create a time-based exclusion for alerts occurring between 02:00 and 04:00 UTC on weekdays, specifically targeting processes named CrowdStrikeService.exe or SentinelOneAgent.exe running under the SYSTEM account.

• Scenario: Automated Backup Verification Jobs

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Commvault run scheduled verification jobs that read and hash critical data files to ensure integrity. The YARA rule may flag these high-volume file access operations, particularly when the backup agent interacts with the sendsafe configuration repository on a central server.
  • Filter/Exclusion: Exclude alerts where the parent process is `