FGint RSAVerify

Hunt Hypothesis

Adversaries may use FGint RSAVerify to bypass code integrity controls and execute malicious payloads in a compromised environment. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential evasion tactics and mitigate advanced threats that evade traditional detection methods.

YARA Rule

rule FGint_RSAVerify
{	meta:
		author = "_pusher_"
		description = "FGint RSAVerify"
	strings:
		$c0 = { 55 8B EC 83 C4 E0 53 56 8B F1 89 55 F8 89 45 FC 8B 5D 0C 8B 45 FC E8 ?? ?? ?? ?? 8B 45 F8 E8 ?? ?? ?? ?? 8D 45 F0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E8 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 E8 8B 45 F8 E8 ?? ?? ?? ?? 8D 55 F0 8B 45 FC E8 ?? ?? ?? ?? 8D 4D E0 8B D3 8D 45 F0 E8 ?? ?? ?? ?? 8D 55 F0 8D 45 E0 E8 ?? ?? ?? ?? 8D 45 E0 50 8B CB 8B D6 8D 45 E8 E8 ?? ?? ?? ?? 8D 55 E8 8D 45 E0 E8 ?? ?? ?? ?? 8D 55 F0 8D 45 E8 E8 ?? ?? ?? ?? 3C 02 8B 45 08 0F 94 00 8D 45 E8 E8 ?? ?? ?? ?? 8D 45 F0 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 E0 8B 15 ?? ?? ?? ?? B9 03 00 00 00 E8 ?? ?? ?? ?? 8D 45 F8 BA 02 00 00 00 E8 ?? ?? ?? ?? C3 }
	condition:
		$c0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: System update or patching using Microsoft Update or WSUS
  Filter/Exclusion: process.name != "wuauclt.exe" or process.name != "wuauserv.exe"

• Scenario: Scheduled job running PowerShell scripts for system maintenance
  Filter/Exclusion: process.name != "powershell.exe" or process.args not contains "System.Management.Automation"

• Scenario: Microsoft Defender Antivirus performing a full system scan
  Filter/Exclusion: process.name != "msascui.exe" or process.name != "mpcmdrun.exe"

• Scenario: SQL Server Agent job executing a backup or maintenance task
  Filter/Exclusion: process.name != "sqlservr.exe" or process.args not contains "SQLAgent"

• Scenario: Windows Task Scheduler running a legitimate administrative task
  Filter/Exclusion: process.name != "schtasks.exe" or process.args not contains "/create"