← Back to SOC feed Coverage →

Looks for big numbers 64:sized

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-04-23T09:00:00Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that the detection rule identifies potential obfuscation or encoding techniques used by adversaries to bypass simple string-based detection mechanisms. A SOC team should proactively hunt for this behavior in Azure Sentinel to uncover advanced threats that may be leveraging large hexadecimal or binary data to hide malicious payloads or commands.

YARA Rule

rule Big_Numbers3
{
	meta:
		author = "_pusher_"
		description = "Looks for big numbers 64:sized"
		date = "2016-07"
	strings:
        	$c0 = /[0-9a-fA-F]{64}/ fullword wide ascii
	condition:
		$c0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/crypto/crypto_signatures.yar