USERNAMEv300

Hunt Hypothesis

This detection identifies potential reconnaissance or lateral movement activities where adversaries manipulate user account identifiers to evade standard naming conventions and blend in with legitimate traffic. A proactive hunt is essential within Azure Sentinel to uncover subtle anomalies in username patterns that may indicate early-stage compromise, ensuring low-severity signals are not overlooked before they escalate into significant threats.

YARA Rule

rule USERNAMEv300
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FB 2E [4] 2E [4] 2E [4] 2E [4] 8C C8 2B C1 8B C8 2E [4] 2E [4] 33 C0 8E D8 06 0E 07 FC 33 F6 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Legitimate deployment of Microsoft Office 365 updates via the built-in Click-to-Run service (OfficeClickToRun.exe) which spawns child processes under the SYSTEM or domain admin context. The YARA rule flags the process name or a specific string match within the update payload as suspicious activity associated with the USERNAMEv300 signature.

  • Suggested Filter: Add an exclusion for the process path C:\Program Files\Microsoft Office Root\Office16\OfficeClickToRun.exe and its child processes when running under the NT SERVICE or specific domain admin accounts (e.g., DOMAIN\UpdateAdmin).

• Scenario: Execution of a scheduled nightly backup job using Veeam Backup & Replication, where the service account (VeeamBackupService) runs scripts that manipulate user profile directories. The rule triggers because the script contains a string pattern matching the USERNAMEv300 logic while accessing user home folders.

  • Suggested Filter: Exclude alerts generated by the process Veeam.Backup.Service.exe when the parent process is Task Scheduler (svchost.exe or taskscheduler.exe) and the execution time falls within the maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: An automated identity governance task performed by SailPoint IdentityIQ, which synchronizes user attributes from Active Directory. The agent process (IISWAM.exe or SailPoint.Agent.exe) reads and writes to the C:\Users\Public directory, triggering the rule due to file access patterns that mimic potential credential harvesting behavior defined in the YARA signature.

  • Suggested Filter: Create a whitelist for the process image hash of the SailPoint agent running under the service account DOMAIN\SailPointService, specifically filtering out events where the accessed file path contains `\Identity