UnoPiX103110BaGiE

Hunt Hypothesis

This YARA rule targets specific memory patterns associated with the UnoPiX103110BaGiE malware family, indicating the presence of a low-severity threat often used for initial access or persistence. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify compromised endpoints early, potentially before the adversary escalates privileges or establishes a foothold in the environment.

YARA Rule

rule UnoPiX103110BaGiE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 04 C7 04 24 00 [3] C3 00 [2] 00 00 00 00 00 00 00 00 00 00 00 00 [2] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 [2] 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 [2] 00 00 00 10 00 00 10 00 00 00 00 00 00 10 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Assembly Scanning by Antivirus/EDR Agents: When enterprise endpoint protection solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) perform deep inspection on legacy .NET assemblies or mixed-mode binaries, the YARA rule may match generic metadata strings or compiler artifacts embedded in standard framework libraries (e.g., System.Core.dll or custom internal libraries). Filter/Exclusion: Exclude files located in standard .NET framework directories (e.g., C:\Windows\Microsoft.NET\Framework*, C:\Program Files\dotnet\) or exclude processes known to be file scanners (e.g., MsMpEng.exe, FalconSensor.exe) when the event type is “File Created” or “File Read” rather than execution.
• Internal Build Artifacts in CI/CD Pipelines: During automated build and test cycles in CI/CD systems (e.g., Azure DevOps, Jenkins, GitLab CI), temporary build artifacts, test harnesses, or obfuscated test binaries may be generated in workspace directories. These files often contain unique string identifiers or version tags that match the YARA signature, especially if the rule targets specific build metadata or debug symbols. Filter/Exclusion: Exclude file paths under common CI/CD workspace directories (e.g., C:\agent\_work\, /var/lib/jenkins/workspace/, D:\builds\) or exclude events where the parent process is a known build agent (e.g., vstest.console.exe, msbuild.exe, java.exe for Maven/Gradle).
• Scheduled Maintenance Scripts in Temp Directories: Many enterprise applications and admin tools (e.g., SCCM, Intune, or custom PowerShell maintenance scripts) write temporary configuration files, logs, or helper executables to the %TEMP% or %LOCALAPPDATA% directories. If these temporary files are derived from a base template