xdedic packed syscan

Hunt Hypothesis

This detection identifies potential adversary activity involving the execution of packed system scanning tools, which may indicate reconnaissance efforts or the deployment of stealthy malware designed to evade signature-based analysis. Proactively hunting for this behavior in Azure Sentinel is critical because low-severity alerts often mask sophisticated initial access attempts that require deeper investigation to prevent lateral movement and data exfiltration before they escalate into high-impact incidents.

YARA Rule

rule xdedic_packed_syscan : crimeware {
meta:
author = "Kaspersky Lab"
company = "Kaspersky Lab"
ref = "https://securelist.com/files/2016/06/xDedic_marketplace_ENG.pdf"
strings:
$a1 = "SysScan.exe" nocase ascii wide
condition:
uint16(0) == 0x5A4D
and any of ($a*) and filesize > 1000000 and filesize <1200000 and
pe.number_of_sections == 13 and pe.version_info["FileVersion"] contains "1.3.4."
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the xdedic_packed_syscan detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Scheduled Scans

  • Scenario: The daily or weekly scheduled full-system scan initiated by Microsoft Defender Antivirus (or CrowdStrike Falcon) launches a packed executable to perform deep analysis. This process often exhibits high entropy and packing characteristics similar to the xdedic signature, particularly when scanning large file repositories.
  • Filter/Exclusion: Exclude processes where the parent image path matches known EDR agents (e.g., C:\Program Files\Microsoft Defender\MsMpEng.exe) AND the command line contains arguments indicating a scheduled scan (e.g., /ScanType=Full).

• Software Deployment via SCCM or Intune

  • Scenario: A System Center Configuration Manager (SCCM) or Microsoft Intune deployment task executes a packed installer (often using Advanced Installer or InstallShield) to push security patches. The installation executable is digitally signed and packed, triggering the rule during the “System Scan” phase of the deployment agent.
  • Filter/Exclusion: Create an exclusion for processes launched by ccmexec.exe (SCCM) or IntuneManagementExtension.exe where the file hash matches a known whitelist of approved software update packages deployed in the last 24 hours.

• Enterprise Backup and Archiving Jobs

  • Scenario: A scheduled backup job using Veeam Backup & Replication or Commvault initiates a pre-backup integrity check. The agent launches a packed utility to compress and verify data blocks before transmission, mimicking the behavior of a system scan tool with high packing ratios.
  • Filter/Exclusion: Filter out alerts where the process name contains “Vee