Vx Backfont900

Hunt Hypothesis

This rule detects the presence of the Vx_Backfont900 YARA signature, which identifies specific malicious code patterns often associated with backdoor or trojan implementations. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious processes before they can establish persistence or execute further post-exploitation actions.

YARA Rule

rule Vx_Backfont900: PEiD
{
    strings:
        $a = { E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a GUI-based text editor (e.g., Notepad++, VS Code, or Sublime Text) to edit configuration files or source code that contains extensive use of the font-family: 'Backfont900' or similar custom font declarations within CSS/HTML assets. The YARA rule may match the binary or text content if it scans open file handles or memory-mapped files, flagging the presence of the specific font name string.

  • Filter/Exclusion: Exclude processes known to be text editors or IDEs (e.g., code.exe, notepad++.exe, sublime_text.exe) from the scan scope, or add an exclusion for file paths ending in .css, .html, or .js if the rule is applied to file content rather than process memory.

• Scenario: An enterprise application or web server (e.g., IIS, Apache, or Nginx) serves a web page or API response that includes a <link> tag or CSS rule referencing the “Backfont900” font file. If the detection logic inspects network traffic or process memory of the web server, the string “Backfont900” may appear in the buffer, triggering a false positive during routine page rendering.

  • Filter/Exclusion: Exclude common web server processes (w3wp.exe, httpd.exe, nginx.exe) from the YARA scan, or filter out network-based detections for HTTP/HTTPS traffic if the rule is not specifically designed for network payload inspection.

• Scenario: A scheduled maintenance job or backup utility (e.g., Veeam, Commvault, or native Windows Backup) creates a snapshot or archive of a directory containing web assets or design files that include the “Backfont900” font. The backup agent process may load these files into memory or temporary