SkDUndetectabler3NoFSG2MethodSkD

Hunt Hypothesis

This detection identifies potentially stealthy malware or suspicious scripts that utilize specific R3 architecture characteristics while lacking standard FSG2 method signatures, suggesting an attempt to evade traditional signature-based defenses. The SOC team should proactively hunt for this behavior in Azure Sentinel to uncover low-severity anomalies that may represent early-stage threats capable of bypassing conventional security controls before they escalate into significant incidents.

YARA Rule

rule SkDUndetectabler3NoFSG2MethodSkD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SkDUndetectabler3NoFSG2MethodSkD rule, along with recommended filters and exclusions:

• Scenario: Microsoft Defender for Endpoint (MDE) Real-Time Protection Scans

  • Context: The MDE service (MsMpEng.exe) frequently spawns child processes to scan files in real-time. These scans often utilize the r3 method without explicitly invoking the FSG2 method signature, triggering the rule when scanning large repositories or during scheduled deep scans.
  • Filter/Exclusion: Add a process exclusion for the parent path C:\Program Files\Microsoft Defender\MsMpEng.exe. Alternatively, apply a filter to exclude alerts where the ParentImage contains “MsMpEng” and the CommandLine includes keywords like “/scan” or “/realtime”.

• Scenario: Scheduled System Backup Jobs (Veeam or Commvault)

  • Context: Enterprise backup agents often run on a schedule (e.g., nightly at 02:00) to archive data. During the indexing phase, these agents instantiate helper processes that utilize the r3 method for rapid file enumeration but may bypass the FSG2 handshake due to high-throughput optimization modes.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 01:00–04:00 daily) specifically for processes named VeeamTransport.exe or CommServeAgent.exe. If the rule supports hash-based filtering, whitelist the specific SHA256 hashes of these backup agents.

• Scenario: Endpoint Configuration Management (SCCM/Intune Deployment)

  • Context: When System Center Configuration Manager (SCCM) or Microsoft Intune pushes software updates or configuration policies, the ccmsetup.exe or `DeviceC