VxNoon1163

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing specific malware signatures identified by the VxNoon1163 YARA rule to detect early-stage malicious activity that may evade standard detection thresholds. Proactively hunting for this behavior in Azure Sentinel is essential to uncover low-severity indicators of compromise before they escalate into significant incidents, ensuring a comprehensive view of emerging threats within the environment.

YARA Rule

rule VxNoon1163
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5B 50 56 B4 CB CD 21 3C 07 [2] 81 [3] 2E [2] 4D 5A [2] BF 00 01 89 DE FC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the VxNoon1163 detection rule, including recommended filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Updates

  • Context: The OfficeClickToRun.exe process frequently spawns child processes to download and apply feature updates or hotfixes. These operations often involve injecting code into the Excel or Word host processes, which can trigger VxNoon1163 if it detects specific memory manipulation patterns typical of update mechanisms.
  • Filter/Exclusion: Exclude any process where ImageFileName is OfficeClickToRun.exe and the parent process is Setup.exe. Alternatively, add a filter for command lines containing /update or /hotfix.

• Scenario: Scheduled Antivirus Real-Time Scanning

  • Context: Enterprise security suites like CrowdStrike Falcon or Symantec Endpoint Protection perform scheduled deep scans during off-hours. When these agents scan large application directories, they may inject hooks into running services to analyze memory states, mimicking the behavior that VxNoon1163 flags as suspicious code injection.
  • Filter/Exclusion: Create an exclusion for processes belonging to known security vendors (e.g., C:\Program Files\CrowdStrike\csagent.exe or Symantec Endpoint Protection Client). Filter out alerts where the parent process is a recognized AV service running on a scheduled trigger.

• Scenario: PowerShell Script Execution by System Admins

  • Context: Administrators often run complex PowerShell scripts (e.g., for user provisioning or log rotation) that utilize System.Management.Automation modules to interact with other applications. These scripts frequently load custom assemblies into the .NET runtime, which can appear as dynamic code loading events triggering this rule.
  • **Filter/Ex