StringDotSimplified

Hunt Hypothesis

This detection identifies potential obfuscation or evasion attempts where adversaries simplify string patterns to bypass standard signature-based defenses within Azure Sentinel workloads. Proactively hunting for these simplified string anomalies is essential to uncover stealthy command-and-control communications or malicious script executions that may otherwise remain hidden beneath low-severity noise.

YARA Rule

rule StringDotSimplified: sharedcode
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"

	strings:
	/*
		F3 AB     rep stosd
		80 3A 00  cmp     byte ptr [edx], 0
		74 15     jz      short loc_404170
		8A 02     mov     al, [edx]
		3C 2E     cmp     al, 2Eh
		74 07     jz      short loc_404168
		3C 20     cmp     al, 20h
		74 03     jz      short loc_404168
		88 06     mov     [esi], al
		46        inc     esi
	*/

	$a = {	F3 AB 	80 ?? 00 	74 ?? 	8A 02 	3C 2E 	74 ?? 	3C 20 	74 ?? 	88 06 	46 }

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the StringDotSimplified detection rule in an enterprise environment, along with recommended filters or exclusions:

• Microsoft Office Macro Execution via excel.exe

  • Scenario: The rule triggers when users open Excel workbooks containing VBA macros. The macro engine often processes strings involving dot notation (e.g., Application.Workbooks.Open) which matches the simplified string pattern, even though no malicious payload is present. This is common during daily financial reporting or HR data entry.
  • Filter/Exclusion: Exclude the process path C:\Program Files\Microsoft Office*\root\Office16\excel.exe (and equivalent paths for Word and PowerPoint) when the parent process is a known user session, specifically filtering out events where the loaded module contains “VBA7.dll”.

• Scheduled System Health Checks via PowerShell

  • Scenario: A scheduled Task Scheduler job runs a PowerShell script (SystemHealthCheck.ps1) that queries WMI objects. The script frequently utilizes dot notation to access object properties (e.g., $obj.Name, $service.Status), generating string patterns that mimic the rule’s signature. This occurs every morning at 06:00 AM across all domain-joined workstations.
  • Filter/Exclusion: Create an exclusion for powershell.exe or pwsh.exe processes where the command line argument contains -File and points to a script in the C:\ProgramData\EnterpriseScripts\ directory, provided the parent process is TaskSchedulerService.

• Software Deployment via SCCM/Intune (MSI Installations)

  • Scenario: During enterprise-wide software updates, the Microsoft Endpoint Configuration Manager (MECM) or Intune agent executes installation packages. The installer (msiexec.exe) parses configuration XML files that heavily rely on dot