Amplia Security Tool

Hunt Hypothesis

This detection rule identifies suspicious activities generated by the Amplia Security Tool to uncover potential adversary reconnaissance or lateral movement behaviors that may evade standard signature-based defenses. Proactively hunting for these signals in Azure Sentinel is critical because they often represent early indicators of compromise that require immediate investigation before adversaries can establish persistence within the environment.

YARA Rule

rule Amplia_Security_Tool
{
    meta:
		description = "Amplia Security Tool"
		score = 60
		nodeepdive = 1
    strings:
		$a = "Amplia Security"
		$b = "Hernan Ochoa"
		$c = "getlsasrvaddr.exe"
		$d = "Cannot get PID of LSASS.EXE"
		$e = "extract the TGT session key"
		$f = "PPWDUMP_DATA"
    condition: 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Amplia Security Tool detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Database Updates via WSUS

  • Context: The Windows Update Service (WUAUENG) triggers Amplia’s background scanning engine to verify integrity after downloading new virus definition signatures from the internal WSUS server. This often occurs daily at 03:00 AM during maintenance windows.
  • Filter/Exclusion: Create a time-based exclusion for the AmpliaService.exe process running under the NT SERVICE\Wuauserv account between 02:00 and 05:00 local time on workdays (Monday–Friday).

• Scenario: Automated Compliance Reporting by Microsoft Defender for Endpoint

  • Context: During end-of-month compliance audits, the Microsoft Defender for Endpoint agent initiates a deep scan that invokes Amplia to cross-reference file hashes against the internal security policy repository. This generates high-volume events as it processes thousands of files in the C:\ProgramData\Compliance directory.
  • Filter/Exclusion: Exclude alerts where the source process is MsSense.exe (Defender) and the target path contains \ProgramData\Compliance, specifically when the event severity is set to “Information” rather than “High”.

• Scenario: Backup Job Execution by Veeam Backup & Replication

  • Context: The nightly Veeam backup job triggers Amplia’s real-time protection module to scan large virtual machine image files (.vmdk and .vhdx) before they are archived. This causes a spike in detection events as the tool validates data integrity during the active transfer phase.
  • Filter/Exclusion: Add an exclusion rule for the `Vee