FSG v133

Hunt Hypothesis

This YARA rule targets specific file signatures associated with the FSG v133 malware family, indicating the presence of a known threat actor’s payload on endpoints. Proactively hunting for these signatures allows the SOC team to identify and isolate low-severity infections before they can establish persistence or escalate privileges within the Azure Sentinel environment.

YARA Rule

rule FSG_v133: PEiD
{
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A DevOps engineer runs a standard docker build command to compile a microservice image, where the Docker daemon or buildkit process temporarily writes intermediate layers to the filesystem in a way that matches the file signature or memory pattern targeted by FSG_v133.

  • Filter/Exclusion: Exclude processes named dockerd, buildkitd, or runc when the parent process is docker or podman, and limit the exclusion to specific container runtime directories (e.g., /var/lib/docker/overlay2/).

• Scenario: An automated backup job using Veeam Backup & Replication or Commvault performs a full system image restore or snapshot creation, causing high-volume file writes and memory allocations that mimic the behavioral footprint of the rule.

  • Filter/Exclusion: Exclude processes associated with backup agents (e.g., VeeamBackupSvc.exe, commvault_agent.exe) when the execution path resides within the vendor’s installation directory (e.g., C:\Program Files\Veeam\Backup and Replication\), and verify the parent process is a service control manager or the backup console.

• Scenario: A security team executes a legitimate vulnerability scan using Nessus or Qualys, where the agent (nessusd or qualys_agent) creates temporary files or loads specific libraries into memory to test service interactions, triggering the YARA signature.

  • Filter/Exclusion: Exclude processes named nessusd, nessus-service, or qualys_agent when the working directory is the vendor’s default temp or work directory (e.g., C:\ProgramData\Tenable\Nessus\ or C:\Program Files\Qualys\), and ensure the process is running under a dedicated service account (e.g., svc_nessus).