ExportTable Check

Hunt Hypothesis

This rule detects the execution of the ExportTable command, which adversaries may use to extract data from Azure Data Explorer (ADX) clusters for exfiltration or reconnaissance. Proactively hunting for this activity allows the SOC team to identify unauthorized data access attempts or lateral movement vectors within the Azure Sentinel environment before sensitive information is compromised.

YARA Rule

rule ExportTableIsBad : PECheck
{
	meta: 
		author = "_pusher_ & mrexodia"
		date = "2016-07"
		description = "ExportTable Check"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		(IsPE32 or IsPE64) and
		( 		//Export_Table_RVA+Export_Data_Size .. cannot be outside imagesize
		((uint32(uint32(0x3C)+0x78+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x7C+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))))     > (uint32(uint32(0x3C)+0x50)) 
		)		
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Scenario: A database administrator uses SQL Server Management Studio (SSMS) to perform a routine backup or migration task by exporting a large table to a CSV file for archival or transfer to a data warehouse.
  • Filter/Exclusion: Exclude alerts where the source executable is ssms.exe or sqlcmd.exe and the destination path ends with .csv or .bak, provided the user belongs to the DB_Admin or Database_Operators security group.
• Scenario: An IT operations team runs a scheduled PowerShell script via Task Scheduler to export user activity logs from a local SQL database to a flat file for ingestion by the SIEM or data lake.
  • Filter/Exclusion: Exclude alerts where the process is powershell.exe or pwsh.exe and the command line contains specific keywords like Export-Csv or Out-File, and the scheduled task name matches known patterns like Daily_Log_Export or SIEM_Ingest.
• Scenario: A data scientist or analyst uses Python (via python.exe or conda.exe) with the pandas library to export a subset of data from a local SQLite or SQL Server database to a Parquet or CSV file for analysis in Jupyter Notebook.
  • Filter/Exclusion: Exclude alerts where the source executable is python.exe, conda.exe, or jupyter.exe, and the destination file extension is .parquet, .csv, or .json, provided the user is in the Data_Science or Analytics group.
• Scenario: A development team uses DBeaver or MySQL Workbench to export table structures or small datasets for documentation or sharing with a partner organization.
  • Filter/Exclusion: Exclude alerts where the source executable is `dbe