FGint DSAPrimeSearch

Hunt Hypothesis

Adversaries may use FGint DSAPrimeSearch to exfiltrate data by leveraging compromised Azure resources, indicating potential lateral movement or data theft. SOC teams should proactively hunt for this behavior to identify and mitigate early-stage data exfiltration attempts in their Azure Sentinel environment.

YARA Rule

rule FGint_DSAPrimeSearch
{	meta:
		author = "_pusher_"
		date = "2016-08"
		description = "FGint DSAPrimeSearch"
		version = "0.1"
	strings:
		$c0 = { 55 8B EC 83 C4 DC 53 56 8B DA 8B F0 8D 45 F8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 F0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 4D F8 8B D6 8B C6 E8 ?? ?? ?? ?? 8D 4D E8 8B D6 8B C3 E8 ?? ?? ?? ?? 8D 55 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D E0 8D 55 E8 8B C3 E8 ?? ?? ?? ?? 8D 45 E8 E8 ?? ?? ?? ?? 8D 4D E8 8D 55 F0 8D 45 E0 E8 ?? ?? ?? ?? 8D 45 E0 E8 ?? ?? ?? ?? 8D 45 F0 E8 ?? ?? ?? ?? 8B 45 EC 8B 40 04 83 E0 01 85 C0 75 18 8D 4D E0 8B D6 8D 45 E8 E8 ?? ?? ?? ?? 8D 55 E8 8D 45 E0 E8 ?? ?? ?? ?? 8B D3 8D 45 E8 E8 ?? ?? ?? ?? C6 45 DF 00 EB 26 8D 4D E8 8D 55 F8 8B C3 E8 ?? ?? ?? ?? 8B D3 8D 45 E8 E8 ?? ?? ?? ?? 8D 4D DF 8B C3 BA 05 00 00 00 E8 ?? ?? ?? ?? 80 7D DF 00 74 D4 8D 45 F8 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? B9 04 00 00 00 E8 ?? ?? ?? ?? C3 }
	condition:
		$c0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Scheduled job for DSAPrimeSearch during routine maintenance
  Filter/Exclusion: process.parent_process_name == "Task Scheduler" or process.command_line contains "scheduled"

• Scenario: Admin performing a manual search via the FGint console
  Filter/Exclusion: process.parent_process_name == "fgint_console.exe" or process.user contains "admin_user"

• Scenario: Automated report generation using DSAPrimeSearch
  Filter/Exclusion: process.command_line contains "generate_report" or process.user contains "reporting_service"

• Scenario: System integrity check or patching process using DSAPrimeSearch
  Filter/Exclusion: process.command_line contains "integrity_check" or process.user contains "patching_service"

• Scenario: Third-party tool integration with FGint for data synchronization
  Filter/Exclusion: process.parent_process_name == "third_party_sync_tool.exe" or process.user contains "sync_user"