Auto-generated rule on file DomainScanV1_0.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries executing reconnaissance or lateral movement activities by deploying a custom executable named “DomainScanV1_0.exe” to map network topology and identify active hosts within the domain. The SOC team should proactively investigate this artifact in Azure Sentinel because low-severity, auto-generated alerts often mask initial foothold establishment that could precede more significant data exfiltration or privilege escalation attacks if left unverified.

YARA Rule

rule DomainScanV1_0 {
	meta:
		description = "Auto-generated rule on file DomainScanV1_0.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
	strings:
		$s0 = "dIJMuX$aO-EV"
		$s1 = "XELUxP\"-\\"
		$s2 = "KaR\"U'}-M,."
		$s3 = "V.)\\ZDxpLSav"
		$s4 = "Decompress error"
		$s5 = "Can't load library"
		$s6 = "Can't load function"
		$s7 = "com0tl32:.d"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the DomainScanV1_0.exe detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus or Endpoint Protection Scans

  • Context: Enterprise security suites like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Symantec Endpoint Protection frequently deploy a scanning utility named DomainScanV1_0.exe during their nightly maintenance windows to audit domain-wide policy compliance.
  • Filter/Exclusion: Create an exclusion based on the Process Name (DomainScanV1_0.exe) combined with a Time Window (e.g., 02:00–04:00 UTC). Additionally, exclude events where the Parent Process is MsMpEng.exe or FalconSensor.exe.

• Scenario: Automated Group Policy Object (GPO) Deployment

  • Context: During the standard GPO refresh cycle (typically every 90 minutes), the Domain Controller pushes a configuration script that instantiates DomainScanV1_0.exe on member servers to verify Active Directory replication health and user attribute consistency.
  • Filter/Exclusion: Filter out alerts where the Source IP belongs to the known range of Domain Controllers (e.g., 10.20.5.0/24) AND the User Account is a service account like DOMAIN\GPO-Service or SYSTEM.

• Scenario: Third-Party Asset Management Inventory Scans

  • Context: Tools such as SolarWinds Service Desk, Lansweeper, or ManageEngine Desktop Central utilize DomainScanV1_0.exe as a lightweight agent to perform periodic hardware and software inventory scans across the enterprise network.
  • Filter/Exclusion: Exclude events