VxFaxFreeTopo

Hunt Hypothesis

This rule detects the presence of the VxFaxFreeTopo YARA signature, which identifies specific malicious or suspicious code patterns often associated with targeted intrusions or web-based exploits. Proactively hunting for this indicator allows the SOC team to identify compromised assets or dormant malware in the Azure Sentinel environment before they can establish persistence or execute lateral movement.

YARA Rule

rule VxFaxFreeTopo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FA 06 33 C0 8E C0 B8 [2] 26 [4] 50 8C C8 26 [4] 50 CC 58 9D 58 26 [4] 58 26 [4] 07 FB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy financial reporting tool (e.g., SAP BusinessObjects or MicroStrategy) uses a background service to generate and transmit daily PDF reports via the FaxOut utility or a custom C# wrapper that calls faxsend.exe directly, rather than using the standard Windows Fax API.
  • Filter/Exclusion: Exclude processes where the parent process is a known application server binary (e.g., java.exe, dotnet.exe, or specific vendor binaries like obiserver.exe) and the command line contains keywords like /report or /daily.
• Scenario: An IT operations team deploys a custom PowerShell script via SCCM or Intune to archive old fax logs by converting them to PDF and sending them to a shared drive using a third-party utility like PDF24 or LibreOffice headless mode, which may invoke fax-related topological checks or file operations that match the YARA pattern.
  • Filter/Exclusion: Exclude events where the initiating user is a service account (e.g., svc_fax_archive) and the process path resides in a dedicated maintenance folder (e.g., C:\Program Files\CorporateTools\Archive\).
• Scenario: A developer testing a new internal fax integration library on a build agent (e.g., Azure DevOps or Jenkins) runs unit tests that simulate fax topology mapping. The test harness creates temporary files and invokes faxcomplib2 or similar COM objects, triggering the rule during the CI/CD pipeline.
  • Filter/Exclusion: Exclude processes running under a build service account (e.g., svc_ci_cd) or within a specific build workspace directory (e.g., C:\agent\_work\).
• Scenario: A Windows Fax Service (`fxssvc