Apex cbeta500mhz

Hunt Hypothesis

This rule detects the presence of the Apex Cobalt Strike beacon variant, indicating an adversary has established a persistent command-and-control channel for lateral movement or data exfiltration. Proactively hunting for this specific beacon allows the SOC team to identify compromised hosts early in the kill chain, minimizing the dwell time of attackers operating within the Azure environment.

YARA Rule

rule Apex_cbeta500mhz
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A development team uses Visual Studio Code or JetBrains IDEs with the Apex Language Extension (or similar Salesforce-specific linters) to compile and validate Apex code locally before deployment. The extension’s background compiler process may match the cbeta500mhz signature if it loads specific beta-version runtime libraries or shared objects.

  • Filter/Exclusion: Exclude processes where the parent process is code.exe (VS Code) or idea64.exe (IntelliJ) and the file path contains \extensions\salesforce\ or \plugins\apex\.

• Scenario: An IT administrator performs a Salesforce Data Loader or Workbench update, or runs the Salesforce CLI (sf command) in a CI/CD pipeline (e.g., Jenkins, Azure DevOps) to deploy Apex classes. The CLI or data loader may spawn a helper process that matches the YARA rule during the compilation or metadata retrieval phase.

  • Filter/Exclusion: Exclude processes where the parent process is sf.exe, data-loader.exe, or java.exe (if running Workbench) and the working directory is within the project’s .sfdx or src folder.

• Scenario: A Jenkins or GitLab CI agent runs a build job that includes a step to execute Apex unit tests via the sf apex run command. The test runner may load a specific beta-version of the Apex runtime or a related native library that triggers the cbeta500mhz signature.

  • Filter/Exclusion: Exclude processes where the parent process is java.exe or node.exe and the command line arguments contain sf apex run or apex:test.

• Scenario: A **