xDedic SysScan unpacked

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing the xDedic SysScan tool to perform system enumeration and file analysis, potentially indicating early-stage reconnaissance or lateral movement within the environment. Proactively hunting for this unpacked YARA signature in Azure Sentinel is critical because it allows the SOC team to identify legitimate security scanning activities versus suspicious usage by unknown processes that may be attempting to map network topology or gather sensitive asset information before escalating attacks.

YARA Rule

rule xDedic_SysScan_unpacked : crimeware {
meta:
author = " Kaspersky Lab"
ref = "https://securelist.com/files/2016/06/xDedic_marketplace_ENG.pdf"
maltype = "crimeware"
type ="crimeware"
filetype = "Win32 EXE"
date = "2016-03-14"
version = "1.0"
hash = "fac495be1c71012682ebb27092060b43"
hash = "e8cc69231e209db7968397e8a244d104"
hash = "a53847a51561a7e76fd034043b9aa36d"
hash = "e8691fa5872c528cd8e72b82e7880e98"
hash = "F661b50d45400e7052a2427919e2f777"
strings:
$a1="/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
$a2="SysScan DEBUG Mode!!!" ascii wide
$a3="This rechecking? (set 0/1 or press enter key)" ascii wide
$a4="http://37.49.224.144:8189/manual_result" ascii wide
$b1="Checker end work!" ascii wide
$b2="Trying send result..." ascii wide
condition:
((uint16(0) == 0x5A4D)) and (filesize < 5000000) and
((any of ($a*)) or (all of ($b*)))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the xDedic SysScan unpacked detection rule in an enterprise environment, along with suggested filters:

• Endpoint Protection Scanning Jobs

  • Scenario: The organization’s primary Endpoint Detection and Response (EDR) agent, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled “On-Demand Scan” during off-hours. During this process, the EDR engine unpacks compressed archives (.zip, .7z) containing software updates to scan their contents before deployment, triggering the SysScan unpacking signature.
  • Suggested Filter: Exclude processes originating from known security vendor paths (e.g., C:\Program Files\CrowdStrike\* or C:\ProgramData\Microsoft\Windows Defender\*) and specifically filter by process names like CsFalconService.exe, MsMpEng.exe, or Sense.exe.

• Software Deployment via SCCM/Intune

  • Scenario: The IT Operations team executes a scheduled deployment of a new application package using Microsoft Endpoint Configuration Manager (MECM/SCCM). As part of the installation sequence, the client agent unpacks the .msi or .cab payloads into a temporary working directory (C:\Windows\CCMCache) to verify integrity before execution, mimicking the behavior of the SysScan tool.
  • Suggested Filter: Create an exclusion for parent processes named ccmexec.exe and restrict the scope to file paths within the standard SCCM cache directories (e.g., C:\Windows\CCMCache\*) or temporary extraction folders (C:\Temp\SCCM_*).

• Automated Backup Verification Scripts

  • Scenario: A nightly maintenance script managed by PowerShell or a third-party backup solution like **