FSGv133Engdulekxt

Hunt Hypothesis

This detection identifies specific file artifacts matching the FSGv133Engdulekxt signature, which may indicate early-stage adversary activity involving known benign or suspicious executables within the environment. Proactive hunting for this pattern in Azure Sentinel is essential to validate whether these occurrences represent legitimate operations or a precursor to broader compromise that requires deeper investigation despite its current low severity classification.

YARA Rule

rule FSGv133Engdulekxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF }
	$a1 = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the FSGv133Engdulekxt YARA rule detection, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Endpoint Antivirus Signature Updates

  • Context: The YARA rule likely flags a specific executable behavior or file hash associated with security software updates. In many enterprises, CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint agents run scheduled signature update tasks every 4 hours. These processes often spawn temporary child processes that match the rule’s logic but are benign.
  • Suggested Filter/Exclusion: Create a whitelist exclusion based on the specific process image path and parent PID.
    • Filter Logic: Exclude if Process.ImagePath contains "C:\Program Files\CrowdStrike\FalconAgent" AND ParentProcess.Name == "falcon.sys" (or equivalent for SentinelOne/Microsoft Defender).

• Scenario: Scheduled PowerShell Script Execution for Patch Management

  • Context: IT Operations teams frequently use Microsoft System Center Configuration Manager (SCCM) or Ansible to push patching scripts. These tools often execute complex PowerShell scripts (powershell.exe) that dynamically generate temporary configuration files or invoke specific DLLs, which can trigger the FSGv133Engdulekxt rule due to similar code patterns in the script engine.
  • Suggested Filter/Exclusion: Exclude events where the command line arguments contain known patching keywords and originate from a trusted management server.
    • Filter Logic: Exclude if Process.CommandLine contains "/c Update-PatchStatus" AND Source.IP == "10.20.30.5" (where 10.20.30.5 is the SCCM site server IP).

• **Scenario: Enterprise Document Conversion via